ASProtectv10

Hunt Hypothesis

This rule detects the presence of executables packed with ASProtect version 10, a technique often used by adversaries to obscure code logic and evade static analysis. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially malicious or obfuscated binaries that may be staging for execution or lateral movement within the environment.

YARA Rule

rule ASProtectv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 [3] 90 5D 81 ED [4] BB [4] 03 DD 2B 9D }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT support engineer is running a standalone installer or updater for a legacy line-of-business application (e.g., old ERP modules or specialized CAD tools) that was compiled with an older version of ASProtect to prevent reverse engineering. The binary is executed from a temporary directory (%TEMP% or C:\Users\<user>\AppData\Local\Temp) during the installation process.

  • Filter/Exclusion: Exclude alerts where the process path contains AppData\Local\Temp or C:\Windows\Temp AND the parent process is a known installer executable (e.g., msiexec.exe, setup.exe, or install.exe) from a trusted application directory.

• Scheduled Backup Agent Execution: A third-party backup or data archiving agent (e.g., Veeam, Acronis, or a custom in-house backup tool) uses an ASProtect-protected binary to handle encryption or compression tasks. This binary is often located in a service directory like C:\Program Files\BackupAgent\bin\ and is triggered by a scheduled task or service start.

  • Filter/Exclusion: Exclude alerts where the process path resides in a known backup software installation directory (e.g., C:\Program Files\Veeam\, C:\Program Files\Acronis\) AND the process name matches a known agent binary (e.g., vssadmin.exe, backupagent.exe, archiver.exe).

• Driver or Firmware Update Utility: A hardware vendor provides a firmware update utility for network adapters, RAID controllers, or BIOS updates that is protected with ASProtect to ensure integrity. This utility is typically run by an administrator from a specific vendor folder (e.g., C:\Program Files\Intel\DriverAndSupportUtils\ or C:\Program Files\AMD\) and may spawn child processes that