ACProtectv190gRiscosoftwareInc

Hunt Hypothesis

This detection identifies the execution of binaries protected by Riso Software’s ACProtect v190g, a technique often employed by adversaries to obfuscate malware and evade static analysis within Azure Sentinel. Proactively hunting for this behavior allows the SOC team to distinguish between legitimate application usage and potential threats leveraging advanced packing mechanisms that may bypass standard signature-based defenses.

YARA Rule

rule ACProtectv190gRiscosoftwareInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ACProtectv190gRiscosoftwareInc detection rule, along with suggested filters or exclusions:

• Scenario: Legitimate deployment of a third-party application (e.g., Adobe Acrobat Pro DC, Microsoft Office Click-to-Run, or Zoom) that utilizes ACProtect v1.90 for its installer executables (setup.exe or AcroRdr64.exe).

  • Suggested Filter/Exclusion: Create a whitelist rule excluding the specific file path and SHA256 hash of known good installers located in standard application directories (e.g., C:\Program Files\Adobe\..., C:\Program Files\Zoom\...).

• Scenario: Scheduled maintenance jobs running by enterprise management tools such as Microsoft SCCM (Configuration Manager) or Jamf Pro that push ACProtect-protected patches or configuration scripts to endpoints during off-hours.

  • Suggested Filter/Exclusion: Exclude processes spawned directly by the management agent service (e.g., ccmexec.exe for SCCM or jamf.exe for Jamf) when they execute child processes containing the ACProtect signature, specifically filtering on the parent process name.

• Scenario: Internal IT administrators manually running a protected utility tool (e.g., a custom Sysinternals Suite wrapper or a proprietary Ransomware Recovery Tool) that is wrapped in ACProtect v1.90 to prevent tampering during execution.

  • Suggested Filter/Exclusion: Implement an exclusion based on the User context, allowing execution when the process is run by members of the “IT_Operations” or “Domain_Admins” groups, or exclude specific file paths in the C:\Tools\Internal\ directory.

• Scenario: Execution of a legitimate **