CPUInfoExtraction

Hunt Hypothesis

This detection identifies adversaries performing initial reconnaissance by querying system processor details to fingerprint the target environment and tailor subsequent attack strategies. SOC teams should proactively hunt for this behavior in Azure Sentinel to establish a baseline of legitimate enumeration activity, enabling the rapid identification of anomalous information gathering that often precedes lateral movement or privilege escalation attempts.

YARA Rule

rule CPUInfoExtraction
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source = "Cmd10010_296fcc9d611ca1b8f8288192d6d854cf4072853010cc65cb0c7f958626999fbd.bin"

	strings:
	/*
		68 00 00 00 80     push    80000000h       ; a2
		8B 02              mov     eax, [edx]
		8B 4A 04           mov     ecx, [edx+4]
		89 4C 24 10        mov     [esp+2Ch+var_1C], ecx
		8B 4A 08           mov     ecx, [edx+8]
		89 4C 24 14        mov     [esp+2Ch+var_18], ecx
		8B 4A 0C           mov     ecx, [edx+0Ch]
		8D 54 24 1C        lea     edx, [esp+2Ch+var_10]
		89 8E 70 03 00 00  mov     [esi+370h], ecx
		52                 push    edx             ; a1
		8B CE              mov     ecx, esi
		89 86 6C 03 00 00  mov     [esi+36Ch], eax
		E8 29 FF FF FF     call    GetCPUIDValues
		8B C8              mov     ecx, eax
		8B 01              mov     eax, [ecx]
		3D 00 00 00 80     cmp     eax, 80000000h
		8B 51 04           mov     edx, [ecx+4]
	*/

	$a = {68 00 00 00 80 8B ?? 8B ?? 04 89 [3] 8B ?? 08 89 [3] 8B ?? 0C 8D [3] 89 [5] 5? 8B ?? 89 [5] E8 [4] 8B ?? 8B ?? 	3D 00 00 00 80 8B ?? 04 }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the CPUInfoExtraction detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Management Agent Heartbeat Scans

  • Scenario: Enterprise endpoint management solutions like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons for ITAM regularly run background agents to inventory hardware specifications. These agents execute commands (e.g., wmic cpu get) to extract CPU model, core count, and speed for asset reporting, triggering the YARA rule without malicious intent.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (ccmexec.exe, IvAgent.exe) and restrict the scope to known Admin Groups or specific Service Accounts (e.g., DOMAIN\SCCM-Inventory-Svc).

• Scheduled System Health Diagnostics

  • Scenario: Scheduled maintenance tasks, such as a nightly PowerShell script (Get-CpuHealth.ps1) running via Task Scheduler, are designed to monitor thermal throttling or CPU utilization trends. These scripts invoke native tools like systeminfo.exe or PowerShell cmdlets to extract detailed processor information for capacity planning dashboards.
  • Suggested Filter/Exclusion: Exclude events where the Parent Process is TaskScheduler (svchost.exe) and the execution path matches a known directory (e.g., C:\Program Files\CorporateTools\Diagnostics\). Alternatively, filter by User Context to exclude runs performed under the SYSTEM or specific DIAGNOSTICS-SVC accounts.

• Software Deployment Pre-Checks

  • Scenario: During major software rollouts using tools like Ansible, Chef, or Chocolatey, deployment agents perform pre-installation checks to verify