← Back to SOC feed Coverage →

Look for SHA2/BLAKE2/Argon2 IVs

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-24T09:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use specific IVs in cryptographic algorithms like SHA2, BLAKE2, or Argon2 to mask or manipulate data during encryption or hashing operations. Proactively hunting for these IVs in Azure Sentinel can help identify potential data tampering or exfiltration attempts that evade standard detection mechanisms.

YARA Rule

rule SHA2_BLAKE2_IVs {
	meta:
		author = "spelissier"
		description = "Look for SHA2/BLAKE2/Argon2 IVs"
		date = "2019-12"
		version = "0.1"
	strings:
		$c0 = { 67 E6 09 6A }
		$c1 = { 85 AE 67 BB }
		$c2 = { 72 F3 6E 3C }
		$c3 = { 3A F5 4F A5 }
		$c4 = { 7F 52 0E 51 }
		$c5 = { 8C 68 05 9B }
		$c6 = { AB D9 83 1F }
		$c7 = { 19 CD E0 5B }

	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 8 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/crypto/crypto_signatures.yar