ImportTable Check

Hunt Hypothesis

This rule detects the execution of the ImportTable command, a common PowerShell technique used by adversaries to load and execute code from CSV files, often serving as a method for lateral movement or initial access. Proactively hunting for this activity in Azure Sentinel allows the SOC team to identify stealthy script-based attacks that may bypass traditional file-based detections and establish a foothold within the environment.

YARA Rule

rule ImportTableIsBad : PECheck
{
	meta: 
		author = "_pusher_ & mrexodia"
		date = "2016-07"
		description = "ImportTable Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(IsPE32 or IsPE64) and
		( 		//Import_Table_RVA+Import_Data_Size .. cannot be outside imagesize
		((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))))     > (uint32(uint32(0x3C)+0x50)) 
		or
		(((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))))  == 0x0)
		//or

		//doest work
		//pe.imports("", "")

		//need to check if this is ok.. 15:06 2016-08-12
		//uint32( uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+uint32(uint32(0x3C)+0x34)) == 0x408000
		//this works.. 
		//uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+uint32(uint32(0x3C)+0x34) == 0x408000
		
		//uint32be(uint32be(0x409000)) == 0x005A
		//pe.image_base
		//correct:

		//uint32(uint32(0x3C)+0x80)+pe.image_base == 0x408000

		//this works (file offset):
		//$a0 at 0x4000
		//this does not work rva:
		//$a0 at uint32(0x0408000)

		//(uint32(uint32(uint32(0x3C)+0x80)+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+pe.image_base) == 0x0)

		or
		//tiny PE files..
		(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) > filesize)

		//or
		//uint32(uint32(0x3C)+0x80) == 0x21000
   		//uint32(uint32(uint32(0x3C)+0x80)) == 0x0
		//pe.imports("", "")
		)				
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Excel Automation via COM Objects: Legitimate business users or scripts may use Microsoft Excel to export data to CSV or import external data sources, which can trigger ImportTable checks if the rule monitors for specific table operations or file handling in Office applications.
  • Filter: Exclude processes where the parent is EXCEL.EXE and the command line contains arguments like /x (export) or /i (import), or restrict the rule to non-Office executable paths.
• PowerShell Data Import/Export: Administrators frequently use Import-CSV, Import-XML, or Import-CliXml cmdlets in PowerShell scripts for configuration management, backup restoration, or data migration tasks.
  • Filter: Exclude events where the process is powershell.exe or pwsh.exe and the command line contains Import- cmdlets, or allowlist specific script paths (e.g., C:\Scripts\Ops\) used by known automation frameworks.
• SQL Server Maintenance Jobs: Scheduled maintenance jobs in SQL Server Agent often perform BACKUP/RESTORE operations or use bcp (Bulk Copy Program) to import/export data between databases or files, which may be interpreted as table imports.
  • Filter: Exclude processes like sqlagent.exe, sqlservr.exe, or bcp.exe when they are spawned by sqlagent.exe or associated with known maintenance job names (e.g., “Daily Backup”, “Index Rebuild”).
• ETL Tools and Data Warehousing: Enterprise ETL tools such as SSIS (SQL Server Integration Services), Talend, or Informatica PowerCenter execute data transformation tasks that involve reading from and writing to tables/files, potentially triggering import checks.
  • Filter: Allowlist specific executable paths for ETL tools (e.g., `dt