Auto-generated rule on file SuperScan4.exe

Hunt Hypothesis

This detection targets potential reconnaissance or lateral movement activities where adversaries utilize the SuperScan4.exe utility to scan network segments and identify vulnerable hosts within the Azure environment. Proactive hunting for this specific executable is essential to distinguish legitimate administrative scanning from anomalous usage patterns that could indicate early-stage threat actor presence before they escalate to more severe attacks.

YARA Rule

rule SuperScan4 {
	meta:
		description = "Auto-generated rule on file SuperScan4.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "78f76428ede30e555044b83c47bc86f0"
	strings:
		$s2 = " td class=\"summO1\">"
		$s6 = "REM'EBAqRISE"
		$s7 = "CorExitProcess'msc#e"
	condition:
		all of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Auto-generated rule on file SuperScan4.exe, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Full Scan Execution

  • Context: The enterprise’s endpoint protection suite (e.g., Symantec Endpoint Protection or Trend Micro) runs a daily full system scan at 02:00 AM. SuperScan4.exe is the core scanning engine invoked during this window, triggering high file I/O and process creation events that mimic suspicious behavior.
  • Filter/Exclusion: Create an exclusion rule based on the process parent (e.g., Symantec Antivirus Service or Trend Micro Agent) and a time-based condition to suppress alerts between 01:00 and 04:00 AM UTC.

• Scenario: Patch Management Deployment via SCCM/Intune

  • Context: During Windows Update cycles, the System Center Configuration Manager (SCCM) or Microsoft Intune agent launches SuperScan4.exe to verify the integrity of downloaded patches before installation. This often occurs during business hours when users are active, causing the rule to flag the scan process as an unexpected execution.
  • Filter/Exclusion: Exclude alerts where the command line arguments contain specific keywords like /patch-verify or /integrity-check, and restrict the scope to machines within the “Patch Management” Active Directory Organizational Unit (OU).

• Scenario: On-Demand Security Audit by IT Administrators

  • Context: A member of the SOC or IT Operations team manually launches a security audit using SuperScan4.exe from their workstation (C:\Program Files\SecurityTools\SuperScan4.exe) to investigate a potential threat on a specific server. The manual initiation lacks the automated context tags usually associated with scheduled