APatch GUI v11

Hunt Hypothesis

This rule detects the presence of the APatch GUI v11 tool, a popular Android patching utility often used by threat actors to modify application binaries or bypass integrity checks on mobile endpoints. Proactively hunting for this tool in Azure Sentinel allows the SOC to identify potential mobile device compromises or unauthorized application tampering that may evade standard network-based detections.

YARA Rule

rule APatch_GUI_v11: PEiD
{
    strings:
        $a = { 52 31 C0 E8 FF FF FF FF }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A mobile device management (MDM) or endpoint security tool (e.g., Intune, AirWatch, or a custom internal agent) deploys the APatch GUI application to specific developer or QA devices for testing Android root functionality. The YARA rule matches the executable or its associated configuration files during a full disk scan or real-time monitoring.

  • Filter/Exclusion: Exclude files located in specific MDM deployment directories (e.g., C:\Program Files\MDM\Deployments\APatch\) or exclude processes spawned by known MDM service executables (e.g., IntuneAgent.exe, AirWatchAgent.exe) from triggering the YARA alert if the file hash matches a known good baseline.

• Scenario: A software development team uses APatch GUI as part of a continuous integration/continuous deployment (CI/CD) pipeline for Android app testing. The GUI is launched via a scheduled task or a CI runner script (e.g., Jenkins, GitLab CI, or Azure DevOps) to apply patches to test builds. The YARA rule detects the GUI process or its memory footprint during the build/test phase.

  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe, vsts-agent.exe) or exclude files in the CI workspace directories (e.g., C:\Jenkins\workspace\, /home/gitlab-runner/builds/) from YARA scanning if the execution context is within a dedicated build server.

• Scenario: An IT support technician manually installs APatch GUI on a jump server or a dedicated Android development workstation to assist a user with a root-related issue. The tool is run from a temporary folder (e.g., C:\Users\<username>\Downloads\ or C:\Temp\) after being downloaded from