RsaEuro NN_modInv

Hunt Hypothesis

The hypothesis is that the detection rule identifies potential cryptographic operations related to RSA key generation, which may indicate adversary use of custom cryptographic libraries or tools. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential advanced persistent threats or unauthorized cryptographic activity.

YARA Rule

rule RsaEuro_NN_modInv
{	meta:
		author = "Maxx"
		description = "RsaEuro NN_modInv"
	strings:
		$c0 = { 81 EC A4 04 00 00 53 56 8B B4 24 BC 04 00 00 57 8D 44 24 0C 56 50 E8 ?? ?? ?? ?? 8D 8C 24 1C 01 00 00 BF 01 00 00 00 56 51 89 7C 24 1C E8 ?? ?? ?? ?? 8B 94 24 C8 04 00 00 56 8D 84 24 AC 01 00 00 52 50 E8 ?? ?? ?? ?? 8B 9C 24 D8 04 00 00 56 8D 8C 24 B0 00 00 00 53 51 E8 ?? ?? ?? ?? 8D 94 24 B8 00 00 00 56 52 E8 ?? ?? ?? ?? 83 C4 30 85 C0 0F 85 F8 00 00 00 8D 84 24 ?? 00 00 00 56 50 8D 8C 24 A0 01 00 00 56 8D 94 24 AC 02 00 00 51 8D 84 24 34 03 00 00 52 50 E8 ?? ?? ?? ?? 8D 8C }
	condition:
		$c0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Regular system backup using Veeam Backup & Replication
  Filter/Exclusion: Exclude processes associated with veeambackup.exe or check for the presence of backup job schedules in the system event logs.

• Scenario: Scheduled system maintenance task using Task Scheduler (e.g., disk cleanup or service restart)
  Filter/Exclusion: Exclude tasks with known maintenance names (e.g., CleanupTemporaryFiles or RestartService) or filter by the TaskScheduler process.

• Scenario: Administrative user performing Windows Update or Group Policy refresh
  Filter/Exclusion: Exclude processes related to wuauclt.exe or gpolusr.exe, or filter based on the user context (e.g., NT AUTHORITY\SYSTEM).

• Scenario: Database indexing or maintenance task using SQL Server Agent Job
  Filter/Exclusion: Exclude processes associated with sqlservr.exe and filter based on the presence of SQL Server Agent job names in the event logs.

• Scenario: Log file rotation or archival using Logrotate (on Linux) or Windows Event Log Management Tool
  Filter/Exclusion: Exclude processes like logrotate or eventvwr.exe and check for log management tool-specific patterns in the event data.