SafeNet family

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing SafeNet family tools to establish persistent access or secure communications within the environment, potentially masking their activities under legitimate security software signatures. Proactively hunting for this behavior in Azure Sentinel is critical because its low severity classification may cause these subtle indicators of compromise to be overlooked during routine monitoring, allowing attackers to maintain a foothold undetected.

YARA Rule

rule SafeNet : Family
{
    meta:
        description = "SafeNet family"
        
    condition:
        SafeNetCode or SafeNetStrings
        
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SafeNet Family detection rule in an enterprise environment, along with targeted filtering strategies:

• Scenario: Automated HSM Key Rotation via Scheduled Task

  • Context: The organization uses Thales SafeNet Luna Network HSM appliances. A nightly scheduled task (e.g., LunaKeyRotation.exe running under the SYSTEM or a dedicated service account like svc-hsm-admin) executes to rotate encryption keys and update certificate chains on the HSM.
  • Filter/Exclusion: Create an exclusion for process names matching Luna*, SafeNet*, or HSMAdmin* when executed from the specific directory path (e.g., C:\Program Files\Thales\Luna Client\bin) and triggered by the known service account.
  • Refinement: Exclude events where the parent process is a Windows Scheduled Task (svchost.exe or TaskScheduler) with a task name containing “HSM” or “KeyRotation”.

• Scenario: Enterprise Software Licensing Validation

  • Context: The enterprise deploys SafeNet Sentinel LDK (License Data Kit) to manage licensing for critical applications like Autodesk AutoCAD, MATLAB, or Oracle Database. Every morning at 08:00, the Sentinel License Manager service (sac.exe) performs a health check and license renewal handshake against the central license server.
  • Filter/Exclusion: Filter out alerts where the process name is sac.exe, slm.exe, or lms.exe located in the standard SafeNet installation directory (e.g., C:\Program Files\Common Files\SafeNet).
  • Refinement: Add a condition to exclude events where the destination port is 1947 (Sentinel default