SafeGuard V10X simonzh2000

Hunt Hypothesis

This hypothesis targets the execution of the SafeGuard V10X malware variant, a known threat actor tool that often establishes persistence or performs initial access tasks on compromised endpoints. Proactively hunting for this specific YARA signature in Azure Sentinel allows the SOC to identify low-severity, potentially stealthy infections before they escalate into lateral movement or data exfiltration activities.

YARA Rule

rule SafeGuard_V10X_simonzh2000: PEiD
{
    strings:
        $a = { E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or sysadmin uses Git for Windows (specifically the git.exe or git-cmd.exe binaries) to clone a repository or perform a commit. The YARA rule likely matches the specific versioning string or embedded metadata in the Git executable that resembles the “SafeGuard V10X” signature, especially if the rule targets specific PE header characteristics common in certain build environments.

  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe or powershell.exe and the image path matches C:\Program Files\Git\cmd\git.exe or C:\Program Files\Git\bin\git.exe. Alternatively, exclude if the process command line contains git clone, git commit, or git push.

• Scenario: An enterprise deployment tool like Ansible or Chef executes a custom script or binary that is compiled with a specific C/C++ compiler version (e.g., MinGW or MSVC) that produces a binary with a similar section layout or import table as the target malware. This is common when deploying custom monitoring agents or log rotation scripts that are statically linked.

  • Filter/Exclusion: Exclude if the process is spawned by ansible-playbook.exe, chef-client.exe, or puppet-agent.exe. Additionally, exclude if the image path resides in standard deployment directories such as C:\ProgramData\Ansible\ or C:\Program Files\Chef\.

• Scenario: A legitimate Java-based application (e.g., a custom internal dashboard or ETL tool) uses a native C++ helper library (.dll or .exe) that is compiled with an older version of the Visual Studio compiler. The YARA rule may be matching on specific import functions (like CreateFile, ReadFile, WriteFile) combined with