ASProtectv12x

Hunt Hypothesis

This rule detects the presence of executables packed with ASProtect v12, a commercial packer frequently abused by threat actors to obscure malicious code and evade static analysis. Proactively hunting for this signature allows the SOC to identify potentially stealthy malware implants that may have bypassed initial perimeter defenses and are executing within the environment.

YARA Rule

rule ASProtectv12x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 68 01 [3] C3 AA }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the ASProtectv12x YARA rule, along with suggested filters or exclusions for a legitimate enterprise environment:

• Legacy Line-of-Business (LOB) Application Updates: Many older enterprise applications (e.g., specific versions of SAP GUI, legacy ERP clients, or proprietary manufacturing software) are packed with ASProtect v12 to protect intellectual property. When these applications are updated via Group Policy or software distribution tools (like SCCM/MECM), the new executable may trigger the rule.

  • Filter/Exclusion: Exclude the specific parent process (e.g., ccmsetup.exe, msiexec.exe) when the child process path matches known LOB application directories (e.g., C:\Program Files\SAP\FrontEnd\, C:\Apps\LegacyERP\). Alternatively, whitelist the specific SHA-256 hash of the updated binary if the vendor confirms it is packed.

• Third-Party Anti-Malware or Endpoint Protection Agents: Some endpoint protection platforms (e.g., certain builds of Kaspersky, ESET, or older Symantec/Bitdefender agents) may use ASProtect packing for their core engine components or update modules to prevent tampering. During agent updates or integrity checks, the packed binaries may be loaded into memory or written to disk.

  • Filter/Exclusion: Exclude processes whose names match known EDR/AV agent binaries (e.g., klnagent.exe, esetsvc.exe, ccSvcHst.exe) or exclude file paths under the vendor’s installation directory (e.g., C:\Program Files\Kaspersky Lab\, C:\Program Files\ESET\).

• Scheduled Maintenance Jobs for Packed Utilities: Administrative scheduled tasks (Task Scheduler) often run maintenance scripts or utilities that are packed with ASProtect to reduce file size