ARMProtector03bySMoKE

Hunt Hypothesis

This YARA rule targets specific ARM-based protector binaries, indicating the use of custom or obfuscated malware components that may evade standard signature-based detections on ARM architecture systems. Proactively hunting for these indicators helps the SOC team identify low-severity, potentially stealthy implantations that could serve as initial footholds or persistence mechanisms within Azure Sentinel-monitored environments.

YARA Rule

rule ARMProtector03bySMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy ARM IoT Device Firmware Updates: When enterprise IT deploys firmware updates to ARM-based IoT gateways (e.g., Raspberry Pi, NVIDIA Jetson, or industrial PLCs) via apt-get or custom scripts, the temporary binary or installer package may match the YARA signature if it contains specific ARM instruction patterns or embedded libraries.
  • Filter/Exclusion: Exclude processes originating from /usr/bin/apt, /usr/sbin/firmware-update, or specific vendor update agents (e.g., nvidia-jetson-update) running on hosts tagged with OS=Linux and Arch=ARM64.
• ARM64 Native Build Tools in CI/CD Pipelines: In DevOps environments using ARM64 runners (e.g., GitHub Actions ARM64 runners or Azure DevOps ARM agents), compiling C/C++ code with gcc-aarch64 or clang can result in intermediate object files or temporary executables that trigger the rule due to standard ARM64 calling conventions or linker stubs.
  • Filter/Exclusion: Exclude files located in /tmp/, /var/tmp/, or workspace directories (e.g., /home/runner/work/) when the parent process is cc1plus, ld, ar, or ninja.
• ARM64 Python/C++ Extension Compilation: When developers or automated jobs compile Python C-extensions (e.g., numpy, pandas, or custom ML libraries) on ARM64 Linux servers, the setup.py build_ext process invokes gcc or cc to create shared libraries (.so files). These binaries often contain ARM64-specific assembly snippets that match the YARA rule.
  • Filter/Exclusion: Exclude files ending in .so or .pyd located in build/ or dist/ directories