TheGuardLibrary

Hunt Hypothesis

This detection identifies potential adversary activity involving the loading or execution of a specific library artifact defined by the “TheGuardLibrary” YARA signature within the Azure Sentinel environment. SOC teams should proactively hunt for this behavior to validate whether the observed library usage represents legitimate application functionality or an early-stage indicator of supply chain compromise and lateral movement attempts.

YARA Rule

rule TheGuardLibrary
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 E8 [4] 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the TheGuardLibrary detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Backup Jobs by Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam.Backup.Service.exe or Commvault.ClientAgent) frequently load the TheGuardLibrary.dll during nightly maintenance windows to scan and encrypt data repositories. The YARA rule may flag this library injection as a suspicious process execution if it occurs outside standard business hours without context.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name and path hash.
    • Filter: Exclude if Parent_Process_Name IN ("Veeam.Backup.Service.exe", "Commvault.ClientAgent") AND Path_Hash == <Known_Good_Hash>.

• Scenario: Endpoint Detection and Response (EDR) Scans by CrowdStrike or SentinelOne

  • Context: When the EDR agent performs a real-time scan or an on-demand full system audit, it often loads TheGuardLibrary to analyze file integrity. This is common during “Deep Scan” events triggered by security policies, which can mimic the behavior of a malicious library injection.
  • Suggested Filter/Exclusion: Exclude alerts where the process command line contains specific EDR scan keywords or originates from the vendor’s installation directory.
    • Filter: Exclude if Command_Line CONTAINS "--scan-type=full" AND Process_Path STARTS_WITH "C:\Program Files\CrowdStrike\”.

• Scenario: Patch Management Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During monthly patching cycles, SCCM (WUAHandler.exe or ccmexec) installs updates that include the `TheGuardLibrary