is hex Rebirth gen3

Hunt Hypothesis

This detection targets adversary behavior characterized by the execution of the specific “is_hex_Rebirth_gen3” malware variant, which may indicate early-stage reconnaissance or persistence activities within the environment. Proactive hunting for this signature in Azure Sentinel is essential to identify low-severity indicators that could serve as precursors to more complex attacks before they escalate into critical incidents.

YARA Rule

rule is__hex_Rebirth_gen3 {
	meta:
		author = "unixfreaxjp"
		date = "2018-01-21"
	strings:
		$hex01 = { 0D C0 A0 E1 00 D8 2D E9 }
		$hex02 = { 3C 1C 00 06 27 9C 97 98 }
		$hex03 = { 94 21 EF 80 7C 08 02 A6 }
		$hex04 = { E6 2F 22 4F 76 91 18 3F }
		$hex05 = { 06 00 1C 3C 20 98 9C 27 }
		$hex06 = { 55 89 E5 81 EC ?? 10 00 }
		$hex07 = { 55 48 89 E5 48 81 EC 90 }
		$hex08 = { 6F 67 69 6E 00 }
	condition:
        	2 of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the is__hex_Rebirth_gen3 detection rule, tailored for an enterprise environment:

• Endpoint Protection Policy Deployment via Hex Rebirth Console

  • Scenario: The SOC team pushes a new signature update or policy configuration from the central Hex Rebirth management console to all managed endpoints. This triggers the YARA rule because the deployment agent (RebirthAgent.exe) executes the same binary payload and memory patterns associated with the “Gen3” engine initialization, which the rule flags as suspicious activity.
  • Filter/Exclusion: Exclude file paths matching C:\Program Files\Hex Rebirth\Agent\* and process names containing RebirthAgent or RebirthService. Additionally, filter events where the parent process is the Hex Rebirth Management Service (RebirthMgr.exe).

• Scheduled Antivirus Full System Scan

  • Scenario: A nightly scheduled task (e.g., via Windows Task Scheduler) initiates a full system scan using the Hex Rebirth Gen3 engine. During this high-I/O operation, the engine loads specific heuristic modules into memory that match the YARA signature for “Gen3” behavioral patterns, causing alerts even though no malicious file was detected by the scanner itself.
  • Filter/Exclusion: Create a time-based exclusion for events occurring between 02:00 and 04:00 UTC on weekdays where the process command line includes arguments like --mode=full-scan or --schedule-id=*. Alternatively, exclude events originating from the specific Scheduled Task ID associated with “Hex Rebirth Nightly Scan.”

• Software Installation via SCCM/Intune (Hex Rebirth Agent Upgrade)

  • Scenario: The IT operations team performs a mass rollout of the Hex Rebirth Gen3 agent upgrade using Microsoft Endpoint Configuration Manager (SCCM) or