Vidgrab code tricks

Hunt Hypothesis

This detection rule identifies anomalous execution patterns associated with Vidgrab code tricks, which adversaries may leverage to establish persistence or execute custom payloads within the environment. Proactively hunting for these specific behaviors in Azure Sentinel is essential to uncover stealthy initial access attempts that might otherwise remain undetected due to their low-severity classification and lack of standard MITRE mapping.

YARA Rule

rule VidgrabCode : Vidgrab Family 
{
    meta:
        description = "Vidgrab code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    strings:
        $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
        
    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Vidgrab code tricks detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scheduled Media Asset Ingestion via PowerShell Scripts

  • Scenario: The IT Operations team runs a nightly PowerShell script (e.g., Sync_VideoAssets.ps1) on the file server to ingest high-resolution video files from external contractors. This process triggers the Vidgrab logic as it rapidly creates, reads, and modifies temporary video codec metadata files in a dedicated staging folder (C:\Staging\Ingest).
  • Filter/Exclusion: Exclude processes running under the SYSTEM or specific service accounts (e.g., svc_media_ingest) where the working directory matches the known ingestion path. Add a filter to ignore events occurring during the maintenance window (02:00–04:00 UTC).

• Automated Video Conference Recording Archiving

  • Scenario: The Microsoft Teams or Zoom administration suite automatically archives recorded meetings. When the backend service (TeamsHost.exe or ZoomService.exe) processes a large batch of recordings, it utilizes Vidgrab-style code tricks to optimize storage by re-encoding segments and updating manifest files. This is often triggered immediately after business hours when meeting volumes peak.
  • Filter/Exclusion: Create an exclusion for the specific executable paths (C:\Program Files\Microsoft Teams\* or C:\Program Files\Zoom\bin\*) combined with a user context of LocalSystem. Additionally, filter out events where the parent process is identified as a known scheduled task (e.g., Task Name: “Archive_Daily_Recordings”).

• Endpoint DLP Agent Scanning and Policy Enforcement

  • Scenario: The enterprise Data Loss Prevention (DLP) agent (such as Symantec DLP or