← Back to SOC feed Coverage →

PubSab Identifying Strings

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-28T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversary activity involving unique identifying strings within the PubSab framework, which may indicate initial reconnaissance or specific service exploitation attempts. Proactively hunting for these patterns in Azure Sentinel allows the SOC team to establish a baseline of legitimate string usage and rapidly distinguish anomalous behaviors before they escalate into higher-severity incidents.

YARA Rule

rule PubSabStrings : PubSab Family
{
    meta:
        description = "PubSab Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $ = "_deamon_init"
        $ = "com.apple.PubSabAgent"
        $ = "/tmp/screen.jpeg"
       
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

False Positive Guidance

Here are 4 specific false positive scenarios for the PubSub Identifying Strings detection rule in an enterprise environment, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_PubSab.yar