Olyx code tricks

Hunt Hypothesis

This rule detects adversaries employing obfuscation or “code tricks” within the Olyx environment to mask malicious activities and evade standard signature-based detection. SOC teams should proactively hunt for these subtle anomalies in Azure Sentinel to identify early-stage evasion tactics that may precede more significant compromise events, ensuring a deeper understanding of the threat landscape beyond high-severity alerts.

YARA Rule

rule OlyxCode : Olyx Family 
{
    meta:
        description = "Olyx code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
        
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Olyx code tricks” detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Antivirus Definition Updates

  • Scenario: The Olyx endpoint agent triggers when the central management server pushes a massive signature database update. This process involves rapid file writes and temporary memory allocations that mimic code injection behaviors, specifically during early morning maintenance windows (e.g., 02:00–04:00 UTC).
  • Filter/Exclusion: Create an exclusion rule for the specific process OlyxUpdateService.exe running under the system account (NT AUTHORITY\SYSTEM) between 01:00 and 05:00 local time. Additionally, exclude file paths containing \Program Files\Olyx\Updates\.

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: During a scheduled rollout of the “Microsoft Office 365 ProPlus” update package, the deployment engine (e.g., ccmexec.exe or msedgeupdate.exe) executes scripts that modify registry keys and inject DLLs into user sessions. The Olyx rule flags these legitimate script executions as potential code trickery due to the high volume of API calls during installation.
  • Filter/Exclusion: Whitelist the parent process ccmexec.exe (System Center Configuration Manager) and any child processes spawned by it that execute within the %ProgramFiles%\Microsoft Intune\Agent directory. Filter out events where the user context is SYSTEM or a dedicated service account like svc-deploy.

• Automated Compliance & Backup Scans

  • Scenario: The nightly execution of enterprise backup software (e.g., Veeam Agent or Commvault) performs deep file system scans. These tools often utilize