Olyx

Hunt Hypothesis

This detection rule identifies anomalous activity associated with the Olyx threat actor, which may indicate early-stage reconnaissance or lateral movement attempts within the Azure environment. Proactively hunting for this behavior is critical to establish a baseline of normal operations and uncover low-severity indicators that could precede more significant security incidents before they escalate.

YARA Rule

rule Olyx : Family
{
    meta:
        description = "Olyx"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    condition:
        OlyxCode or OlyxStrings
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Olyx detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated Patch Deployment via SCCM/WSUS

  • Scenario: The System Center Configuration Manager (SCCM) or Windows Update Services (WSUS) server initiates a scheduled mass deployment of security patches. This triggers the Olyx rule because the patching agent performs high-volume file writes and registry modifications across thousands of endpoints simultaneously, mimicking suspicious bulk activity.
  • Filter/Exclusion: Create an exclusion for the specific service account used by the SCCM client (e.g., NT AUTHORITY\SCCM or a dedicated svc_sccm_patch identity) running on the primary distribution points. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC weekdays).

• Enterprise Backup Operations with Veeam

  • Scenario: The nightly backup job executed by Veeam Backup & Replication performs a full image capture of critical file servers. This process involves reading and writing massive amounts of data to the storage array, often triggering Olyx alerts due to unusual I/O patterns or temporary spikes in network traffic from the backup proxy servers.
  • Filter/Exclusion: Exclude traffic originating from the Veeam Backup Proxy service accounts (e.g., svc_veeam_proxy) and destination IP ranges associated with the backup repository storage. A time-based filter can also be applied to suppress alerts during the standard backup window (e.g., 20:00–06:00 local time).

• Log Collection by Splunk Universal Forwarders

  • Scenario: The deployment of new log collection configurations via Splunk Universal Forwarders results in a sudden increase in file system access and network connections