Auto-generated rule on file Stealth.exe

Hunt Hypothesis

This hypothesis detects the execution of a potentially suspicious or newly introduced binary named “Stealth.exe,” which may indicate an adversary attempting to blend in with legitimate system processes using generic naming conventions. Proactively hunting for this file in Azure Sentinel is essential to identify early-stage lateral movement or persistence mechanisms that might evade standard signature-based detections due to their low-severity and auto-generated nature.

YARA Rule

rule stealth_Stealth {
	meta:
		description = "Auto-generated rule on file Stealth.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
	strings:
		$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
		$s6 = "This tool may be used only by system administrators. I am not responsible for "
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Auto-generated rule on file Stealth.exe, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Self-Scan

  • Context: The endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Sophos) often utilizes a component named Stealth.exe to perform background scanning, real-time monitoring updates, or self-protection checks. This process frequently spawns new file instances or modifies existing ones during its scheduled maintenance window, triggering the rule.
  • Filter/Exclusion: Exclude processes where the parent process is the known EDR agent service (e.g., csfalcon.exe, MsMpEng.exe, or SophosService.exe) and the user context is SYSTEM. Additionally, add a filter to ignore events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Deployment of Third-Party Security Utilities

  • Context: Enterprise IT often deploys specialized security tools such as “Stealth” by specific vendors (e.g., Stealth Software Solutions or a custom internal wrapper) for data loss prevention (DLP) or USB device control. When these agents are updated via SCCM/Intune or installed during onboarding, Stealth.exe is executed to initialize policies and register drivers, causing file creation events that mimic suspicious activity.
  • Filter/Exclusion: Create an exclusion based on the specific SHA-256 hash of the legitimate vendor’s Stealth.exe. Furthermore, filter out events where the installation source is a known deployment tool (e.g., parent process ccmexec.exe for SCCM or MsMpSetup.exe).

• Scenario: Admin Maintenance and Patching Tasks

  • **Context