ASProtectv11MTEc

Hunt Hypothesis

This rule detects the presence of executables packed with ASProtect v11, a commercial packer frequently abused by threat actors to obscure malicious code and evade static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify potentially compromised endpoints or suspicious artifacts that may have been deployed to establish a foothold or execute stealthy payloads.

YARA Rule

rule ASProtectv11MTEc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 1B [3] E9 FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT administrator is updating a legacy line-of-business application (e.g., a custom .NET or C++ desktop tool) that was originally compiled with the AsProtect v11.0 MTEC protection layer. The binary is being copied to a shared network drive or deployed via Group Policy for patching.

  • Filter/Exclusion: Exclude file paths under specific application directories (e.g., C:\Apps\LegacyERP\bin\) or exclude hashes of known stable versions of the application binaries.

• Third-Party Vendor Updates: A vendor-provided utility (such as a database backup agent, antivirus definition updater, or hardware monitoring tool) is installed or updated. These tools are often packed with AsProtect to protect intellectual property or reduce file size, and the executable is dropped in C:\Program Files\VendorName\ or C:\ProgramData\VendorName\.

  • Filter/Exclusion: Create a whitelist of known vendor executable names (e.g., VendorBackupAgent.exe, VendorUpdater.exe) or exclude files located in specific vendor installation directories.

• Scheduled Maintenance Jobs: A scheduled task runs a maintenance script that invokes a packed utility (e.g., a log rotation tool or disk cleanup utility) from a standard system or admin folder. The utility was built with AsProtect v11 MTEC and is executed by Task Scheduler (svchost.exe or taskschd.msc context).

  • Filter/Exclusion: Exclude executions where the parent process is Task Scheduler (taskschd.msc or svchost.exe with specific service names) and the file path matches known maintenance tool locations (e.g., C:\AdminTools\, C:\Scripts\).

• Development/Testing Environments: A developer or QA engineer is testing a