Mirage Identifying Strings

Hunt Hypothesis

Adversaries may use obfuscated or hidden strings to identify and execute malicious payloads, which could indicate early-stage compromise. SOC teams should proactively hunt for these strings in Azure Sentinel to detect potential adversarial reconnaissance and prevent further escalation.

YARA Rule

rule MirageStrings
{
    meta:
        description = "Mirage Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        $ = "Neo,welcome to the desert of real." wide ascii
        $ = "/result?hl=en&id=%s"
        
    condition:
       any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: Scheduled Backup Job Using find Command
  Description: A legitimate backup process uses the find command to locate and archive files, which may include strings that match the detection logic.
  Filter/Exclusion: Exclude processes initiated by the backup scheduler (e.g., cron, systemd-timedated, or specific backup tools like rsnapshot, borgbackup, or Veeam) using the process.parent or process.name fields.

• Scenario: Log Rotation Using logrotate
  Description: The logrotate utility may generate log files that include strings matching the detection rule, especially when rotating large volumes of logs.
  Filter/Exclusion: Exclude processes with process.name equal to logrotate or logrotate in the command line, or filter by process.parent if initiated by a system service.

• Scenario: System Integrity Check with tripwire or AIDE
  Description: Security tools like tripwire or AIDE scan system files and may output strings that match the detection logic during integrity checks.
  Filter/Exclusion: Exclude processes with process.name matching tripwire, aide, or ossec, or filter by process.parent if initiated by a security service.

• Scenario: Admin Task Using strings Command on Binary Files
  Description: System administrators may use the strings command to analyze binary files (e.g., for debugging or forensic analysis), which could trigger the rule.
  Filter/Exclusion: Exclude processes where the command line includes strings and the file being processed is a known system binary (e.g., /bin/, /lib/, or /usr/bin/), or filter by process.user to exclude non-admin users.

• **Scenario: