sets pos

Hunt Hypothesis

This hypothesis targets adversaries attempting to manipulate process execution or inject code by leveraging specific POSIX system call patterns identified through the sets_pos YARA signature. Proactive hunting for this behavior in Azure Sentinel is essential to uncover subtle, low-severity lateral movement or persistence activities that may evade standard high-fidelity alerting mechanisms.

YARA Rule

rule sets_pos
{
meta:
	author = "@patrickrolsen"
	reference = "POS malware - Sets"
strings:
	$s1 = "GET /sets.txt"
condition:
	uint16(0) == 0x5A4D and $s1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• POS malware - Sets
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the sets_pos detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Real-Time Scanning on System Directories

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently scan large system directories or application binaries. During these scans, the AV engine may spawn temporary processes that set specific process attributes or modify registry keys matching the sets_pos signature, particularly when scanning executables in %ProgramFiles% or %SystemRoot%\System32.
  • Filter/Exclusion: Create a rule exclusion for known AV service processes (e.g., MsMpEng.exe, CsFalconService.exe) and their child processes. Additionally, exclude file paths matching the standard installation directories of these security tools to prevent alerts during routine scanning cycles.

• Scheduled Group Policy Updates by System Administrators

  • Scenario: During business hours or maintenance windows, Domain Controllers push updated Group Policy Objects (GPO) via gpupdate.exe or scheduled tasks managed by tools like SCCM (Microsoft Endpoint Configuration Manager). These operations often involve setting security policies, modifying user rights assignments, and updating system configurations that trigger the logic defined in the YARA rule.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC). Furthermore, exclude events originating from specific administrative service accounts (e.g., DOMAIN\svc-gpo-update, SYSTEM) and processes named gpupdate.exe or ccmexec.exe.

• Software Deployment via Intune or Jamf

  • Scenario: Automated software deployment agents (such as Microsoft Intune Company Portal or Jamf Pro) routinely install, update, or patch applications.