Detects Versions of LogPOS

Hunt Hypothesis

This rule detects adversary behavior involving the enumeration or modification of LogPOS versions, which may indicate an attacker establishing persistence or preparing for data exfiltration within point-of-sale systems. The SOC team should proactively hunt for this activity in Azure Sentinel to identify subtle configuration changes that often precede more critical incidents and ensure baseline integrity across retail environments.

YARA Rule

rule LogPOS
{
    meta:
        author = "Morphick Security"
        description = "Detects Versions of LogPOS"
        md5 = "af13e7583ed1b27c4ae219e344a37e2b"
    strings:
        $mailslot = "\\\\.\\mailslot\\LogCC"
        $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process="
        //64A130000000      mov eax, dword ptr fs:[0x30]
        //8B400C        mov eax, dword ptr [eax + 0xc]
        //8B401C        mov eax, dword ptr [eax + 0x1c]
        //8B4008        mov eax, dword ptr [eax + 8]
        $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 }
    condition:
        $sc and 1 of ($mailslot,$get)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects Versions of LogPOS” rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Patch Management Deployments

  • Scenario: During a weekly maintenance window (e.g., Sunday at 02:00 UTC), the IT Operations team uses Microsoft SCCM (System Center Configuration Manager) to push a cumulative update for LogPOS across all Point-of-Sale terminals. This triggers version change events on hundreds of endpoints simultaneously, mimicking a potential unauthorized software installation or supply chain attack.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts where the EventSource matches “SCCM” and the ProcessName is ccmexec.exe, specifically during the defined maintenance window (01:30–04:30 UTC).

• Automated Compliance Audits by Security Tools

  • Scenario: The enterprise EDR solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs an automated inventory scan every morning at 08:00. As part of this routine health check, the agent queries the registry and file system to verify the installed version of LogPOS against the baseline configuration, generating a “version detected” event that is indistinguishable from a live change.
  • Filter/Exclusion: Filter out events where the InitiatingProcess belongs to known security agents (e.g., csagent.exe, MsMpEng.exe) and the action type is explicitly marked as “Read-Only Inventory” or “Configuration Scan.”

• LogPOS Self-Service Configuration Updates

  • Scenario: Regional store managers utilize the built-in LogPOS Admin Console to apply minor configuration patches (e.g., updating tax tables or receipt templates) which internally trigger a version metadata refresh