CRC32 table lookup

Hunt Hypothesis

Adversaries may use CRC32 table lookups as part of obfuscation or data manipulation techniques to evade signature-based detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential advanced persistent threats that rely on algorithmic manipulation to remain undetected.

YARA Rule

rule CRC32_table_lookup {
	meta:
		author = "_pusher_"
		description = "CRC32 table lookup"
		date = "2015-06"
		version = "0.1"
	strings:
		$c0 = { 8B 54 24 08 85 D2 7F 03 33 C0 C3 83 C8 FF 33 C9 85 D2 7E 29 56 8B 74 24 08 57 8D 9B 00 00 00 00 0F B6 3C 31 33 F8 81 E7 FF 00 00 00 C1 E8 08 33 04 BD ?? ?? ?? ?? 41 3B CA 7C E5 5F 5E F7 D0 C3 }
	condition:
		$c0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: System update using rsync or scp to transfer files with known CRC32 hashes
  Filter/Exclusion: Exclude processes associated with rsync, scp, or yum/apt package managers using process name or command line arguments.

• Scenario: Scheduled backup job using tar or rsync that includes known CRC32 hashes in the backup archive
  Filter/Exclusion: Exclude processes with tar, rsync, or backup in the command line, or filter by user account used for backups.

• Scenario: Admin task involving md5sum or sha1sum to verify file integrity, which may include CRC32 hash values in logs
  Filter/Exclusion: Exclude processes with md5sum, sha1sum, or sha256sum in the command line, or filter by user account with administrative privileges.

• Scenario: Log file rotation using logrotate that includes CRC32 checksums in log entries
  Filter/Exclusion: Exclude processes with logrotate in the command line, or filter by log file paths commonly used by log rotation tools.

• Scenario: Network monitoring tool like tcpdump or Wireshark capturing CRC32 checksums during packet analysis
  Filter/Exclusion: Exclude processes with tcpdump, Wireshark, or tshark in the command line, or filter by network interface used for monitoring.