Infinity

Hunt Hypothesis

This detection targets adversary behavior characterized by specific file patterns identified through the Infinity YARA signature, which often indicate early-stage reconnaissance or benign tool usage that may precede more complex attacks. The SOC team should proactively hunt for these indicators in Azure Sentinel to establish a baseline of normal activity and identify potential false negatives where low-severity signals could evolve into significant threats if left unmonitored.

YARA Rule

rule Infinity : RAT
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Infinity"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Infinity detection rule in a legitimate enterprise environment, including suggested filters or exclusions:

• Antivirus Real-Time Scanning & Definition Updates

  • Scenario: The Infinity YARA rule likely detects high-frequency file creation, modification, or memory injection patterns. Enterprise Antivirus solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) frequently trigger these signatures during real-time scanning sweeps or when pushing new virus definition updates to endpoints.
  • Suggested Filter/Exclusion: Exclude processes running under the specific antivirus service accounts and filter out file paths located in standard AV quarantine or update directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates). Additionally, create a whitelist for known AV executable hashes.

• Scheduled Enterprise Backup Jobs

  • Scenario: Automated backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik perform intensive I/O operations during nightly maintenance windows. These jobs often spawn temporary child processes that read/write large data blocks, mimicking the behavior patterns (e.g., rapid file enumeration or memory mapping) targeted by the Infinity rule.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for alerts generated between 01:00 and 05:00 UTC on weekdays. Furthermore, exclude process trees initiated by backup service accounts (e.g., DOMAIN\svc-veeam-backup) and specific command-line arguments containing keywords like “backup,” “snapshot,” or “replication.”

• Software Deployment via Configuration Management Tools

  • Scenario: During patch Tuesday cycles, configuration management tools like Ansible, Chef, or Microsoft SCCM (Configuration Manager) push updates to thousands of endpoints. The deployment agents often execute scripts that install packages