TaggantSignature Check

Hunt Hypothesis

This rule detects the presence of specific Taggant signature artifacts, which may indicate an adversary using steganographic or hidden data embedding techniques to exfiltrate information or establish covert channels. Proactively hunting for these signatures allows the SOC team to identify low-and-slow data exfiltration attempts that often evade traditional network-based detections in Azure Sentinel.

YARA Rule

rule HasTaggantSignature : PECheck
{
	meta: 
		author="_pusher_"
		description = "TaggantSignature Check"
		date="2016-07"
	strings:		
		$a0 = { 54 41 47 47 ?? ?? ?? ?? ?? ?? 00 00 ?? 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 09 30 07 06 05 2B 0E 03 02 1A 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 01 A0 82 ?? ?? 04 82 ?? ?? ?? 00 01 00 ?? ?? }
		//$c0 = { 06 09 2A 86 }
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//TAGG+4E==packerid
		//(uint32be(@a0+0x4E) == 0x0B51D132) and
		//(uint32be(@a0+0x12) == 0x006092a86) and
		//(uint32be(@a0+0x12)) == uint32be(@c0) and

		//uint32be(@a0+0x04) < (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) and
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Hardware Inventory and Asset Management Scans

  • Scenario: Enterprise asset management tools like ServiceNow Hardware Inventory Agent or BigFix perform deep hardware fingerprinting. These agents often read the Taggant signature (a unique hardware identifier) from the BIOS/UEFI or specific chipset registers to uniquely identify endpoints for compliance and warranty tracking.
  • Filter/Exclusion: Exclude processes where the parent process is hwinv.exe (ServiceNow) or bfxagent.exe (BigFix) and the command line contains arguments related to “inventory,” “fingerprint,” or “hardware scan.”

• BIOS/UEFI Firmware Update Utilities

  • Scenario: OEM-provided firmware update tools, such as Dell Command Update (dcu.exe), Lenovo System Update (sysupdate.exe), or HP Client Management utilities, may query the Taggant signature to verify hardware compatibility before applying a BIOS update. This ensures the new firmware is compatible with the specific hardware revision identified by the signature.
  • Filter/Exclusion: Exclude execution by known OEM update binaries (e.g., dcu.exe, sysupdate.exe, hpupdate.exe) when the working directory is within the vendor’s installation path (e.g., C:\Program Files\Dell\CommandUpdate\ or C:\Program Files\Lenovo\Update\).

• Pre-Boot Execution Environment (PXE) and Imaging Agents

  • Scenario: Network boot and imaging agents like Microsoft Deployment Toolkit (MDT) or Fog Project clients may read the Taggant signature during the pre-boot phase to generate a unique machine ID for the deployment database. This allows the server to map the physical hardware to a specific image or configuration profile.
  • Filter/Exclusion: Exclude processes running