T5000 Identifying Strings

Hunt Hypothesis

This rule detects adversaries attempting to establish a foothold by identifying and cataloging unique strings within system logs that may indicate initial reconnaissance or command execution artifacts. The SOC team should proactively hunt for these patterns in Azure Sentinel to correlate seemingly benign low-severity events with broader attack narratives, ensuring early visibility into potential lateral movement before more critical alerts trigger.

YARA Rule

rule T5000Strings : T5000 Family
{
    meta:
        description = "T5000 Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-26"
        
    strings:
        $ = "_tmpR.vbs"
        $ = "_tmpg.vbs"
        $ = "Dtl.dat" wide ascii
        $ = "3C6FB3CA-69B1-454f-8B2F-BD157762810E"
        $ = "EED5CA6C-9958-4611-B7A7-1238F2E1B17E"
        $ = "8A8FF8AD-D1DE-4cef-B87C-82627677662E"
        $ = "43EE34A9-9063-4d2c-AACD-F5C62B849089"
        $ = "A8859547-C62D-4e8b-A82D-BE1479C684C9"
        $ = "A59CF429-D0DD-4207-88A1-04090680F714"
        $ = "utd_CE31" wide ascii
        $ = "f:\\Project\\T5000\\Src\\Target\\1 KjetDll.pdb"
        $ = "l:\\MyProject\\Vc 7.1\\T5000\\T5000Ver1.28\\Target\\4 CaptureDLL.pdb"
        $ = "f:\\Project\\T5000\\Src\\Target\\4 CaptureDLL.pdb"
        $ = "E:\\VS2010\\xPlat2\\Release\\InstRes32.pdb"
        
    condition:
       any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the T5000 Identifying Strings detection rule in an enterprise environment:

• Automated Backup Script Execution

  • Scenario: The nightly backup job executed by Veeam Backup & Replication or Commvault scans large database files (e.g., .sql, .mdf) and generates log entries containing the specific “T5000” identifying string within file headers or metadata descriptions. This occurs during peak maintenance windows (e.g., 02:00 – 04:00 UTC) across multiple file servers, triggering high-volume alerts that mimic suspicious data exfiltration.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from the Veeam/Commvault Service Accounts (e.g., svc-veeam-backup) and destination IPs within the dedicated backup storage subnet (10.50.20.0/24). Additionally, restrict the alert to only trigger outside of the defined maintenance window if the string appears during off-hours.

• Software Deployment via Configuration Management

  • Scenario: During a scheduled patch Tuesday rollout, Ansible or Chef agents push configuration updates to application servers. The deployment scripts modify registry keys and configuration files (.xml, .json) that embed the “T5000” string as a version identifier or license check marker. This activity generates thousands of file access events on endpoints running the Microsoft Endpoint Configuration Manager (MECM) agent, falsely indicating unauthorized string manipulation.
  • Filter/Exclusion: Exclude processes initiated by known configuration management binaries (ansible-playbook.exe, chef-client.exe) and user accounts prefixed with svc-deploy-. Implement a time-based filter to suppress alerts during the standard deployment window (e.g., Monday 19:00