Detects refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to preve

Hunt Hypothesis

This hunt hypothesis targets adversaries embedding specific refusal magic strings in files to disrupt Large Language Model (LLM) analysis and evade automated security scanning. Proactively hunting for this behavior in Azure Sentinel is critical because it reveals sophisticated evasion tactics where malicious artifacts actively terminate Claude sessions, potentially allowing threats to bypass AI-driven detection mechanisms.

YARA Rule

rule SUSP_Claude_Refusal_Magic_String_Jan26 {
   meta:
      description = "Detects refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "https://x.com/williballenthin/status/2014687699165135150"
      hash = "ffa48ed4b7b48897f6756c4222b2606399de0bca627cedfddf61e69986580430"
      score = 75
      id = "7a164817-9e90-52f6-a3cb-e6965ee1cc54"
   strings:
      $x1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_" ascii wide nocase
   condition:
      $x1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Detects refusal magic string that cause Claude sessions to be terminated” rule, including suggested filters and exclusions:

Scenario: Automated Backup Encryption Handshake
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often generate temporary staging files during the encryption handshake phase. These tools may embed a specific “refusal” signature in metadata headers to signal that the file is currently locked for I/O operations, which can be misinterpreted as an active attempt to block LLM analysis.
- Suggested Filter/Exclusion: Exclude processes running under the VeeamBackup.exe or commvault_service user context where the file extension is .vbm (Veeam) or .cvm. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00 – 04:00 UTC).
Scenario: CI/CD Pipeline Artifact Generation
- Context: Continuous Integration tools such as Jenkins, GitLab Runner, or Azure DevOps frequently create build artifacts and container images. During the “packaging” stage, these agents often write a manifest file containing a refusal string to indicate that the artifact is in a transient state (not yet ready for full content inspection) before deployment.
- Suggested Filter/Exclusion: Create an exclusion rule for files located within specific build directories (e.g., C:\Jenkins\workspace\build-artifacts or /var/lib/gitlab-runner/caches). Exclude events where the parent process name contains keywords like “jenkins-agent”, “gitlab-runner”, or “azdo-build”.
Scenario: Antivirus Real-Time Scanning Locks
- Context: Endpoint Protection platforms like **CrowdStrike