WIBUKeyV410Ahttpwibucomus

Hunt Hypothesis

This rule detects the presence of WIBU-Plus Key Manager software, a hardware security module often used for cryptographic key storage and management in enterprise environments. Proactively hunting for this signature helps the SOC team identify potential lateral movement or data exfiltration vectors where adversaries may leverage these specific key management tools to access sensitive cryptographic assets within the Azure Sentinel environment.

YARA Rule

rule WIBUKeyV410Ahttpwibucomus
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 05 [4] FF 00 00 00 75 12 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Wibu-Systems License Server Updates: The wibukey service or its associated license manager (e.g., wibukey.exe or wibukeyd.exe) often initiates HTTP/HTTPS connections to wibu.com or specific regional license servers (like wibu.com/us) to validate floating licenses, check for updates, or report usage metrics.
  • Filter/Exclusion: Exclude outbound HTTP traffic from processes named wibukey.exe, wibukeyd.exe, or wibukey64.exe where the destination domain contains wibu.com or wibukey.com.
• Hardware Key Driver Initialization: When a WIBUKey hardware dongle is inserted or the system boots, the WIBUKey driver service (wibukeyd.sys or wibukeyd.exe) may perform a one-time connectivity check to the WIBU-Systems cloud infrastructure to register the key ID or verify the license status before allowing application access.
  • Filter/Exclusion: Exclude connections initiated by the wibukeyd service or processes running under the WIBU-Systems vendor name, specifically if the connection occurs within the first 5 minutes of system boot or key insertion.
• Legacy Application License Validation: Older versions of software protected by WIBU-Systems (such as certain CAD, PLM, or industrial control system applications) may directly call the WIBU-Systems license server via HTTP for validation if the local license file is corrupted or if a “cloud license” feature is enabled.
  • Filter/Exclusion: Exclude HTTP requests to wibu.com or wibukey.com originating from known legacy application executables (e.g., nx.exe, catia.exe, solidworks.exe) that have the WIBU-Systems protection library (wibukey.dll) loaded