← Back to SOC feed Coverage →

hex script

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-22T11:00:00Z · Confidence: medium

Hunt Hypothesis

The hex_script rule detects potential obfuscation techniques where adversaries may encode or hide malicious payloads within hexadecimal data to evade basic detection mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage adversarial activity that could lead to more sophisticated attacks.

YARA Rule

rule hex_script {
    strings:
        $ = "\\x73\\x63\\x72\\x69\\x70\\x74\\x22"
    condition: 
        any of them and filesize < 500KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_Magento_suspicious.yar