ASProtect13321RegisteredAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of a legitimate software component protected by ASProtect 13321, specifically associated with Alexey Solodovnikov, which may indicate normal application usage or potential supply chain compromise if observed in unexpected contexts. The SOC team should proactively hunt for this signature within Azure Sentinel to establish a baseline of trusted behavior and quickly distinguish between benign operations and adversaries leveraging known legitimate binaries to evade detection.

YARA Rule

rule ASProtect13321RegisteredAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 [3] E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ASProtect13321RegisteredAlexeySolodovnikov detection rule, tailored for an enterprise environment:

• Corporate License Management Tool Execution

  • Scenario: The enterprise utilizes a centralized software licensing solution (e.g., FlexNet Publisher or Reprise) that periodically validates ASProtect-protected applications. During the validation cycle, the service process (flexnet_service.exe or similar) loads the specific registered module associated with Alexey Solodovnikov to verify license integrity on endpoints.
  • Filter/Exclusion: Create a rule exclusion based on the parent process name flexnetd.exe (or the specific vendor’s service executable) and restrict the scope to the “Software Asset Management” security group or specific server OU where licensing agents are deployed.

• Scheduled Patch Deployment via SCCM

  • Scenario: A nightly scheduled task in Microsoft Endpoint Configuration Manager (SCCM) deploys a critical update for an ASProtect-protected financial application. The deployment agent (ccmexec.exe) extracts and executes the installer, which triggers the YARA signature upon reading the registered configuration file during the installation phase.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe or ccmexec.exe running under the “System” account context between 01:00 and 05:00 UTC, as this aligns with the standard maintenance window for patching.

• DevOps CI/CD Pipeline Artifact Validation

  • Scenario: The internal DevOps platform (Jenkins or Azure DevOps) runs a nightly build pipeline that compiles and packages the protected application. During the “Artifact Verification” stage, the build agent (java.exe for Jenkins or msbuild.exe for Azure) scans the