ASProtectV2XDLLAlexeySolodovnikov

Hunt Hypothesis

This hunt detects the presence of ASProtect v2.x DLL files associated with Alexey Solodovnikov, which are frequently utilized by malware authors to obfuscate and protect malicious payloads within Windows environments. Proactively hunting for these artifacts in Azure Sentinel is essential because their low-severity classification often allows them to evade standard alerting thresholds while serving as a critical indicator of advanced persistent threats leveraging code integrity mechanisms.

YARA Rule

rule ASProtectV2XDLLAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 [2] 5D 45 55 C3 E8 01 00 00 00 EB 5D BB [4] 03 DD }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ASProtectV2XDLLAlexeySolodovnikov detection rule, along with targeted filters and exclusions:

• Scenario: Execution of the ASProtect Loader (asprotect.dll) by legitimate enterprise software suites that utilize ASProtect for license management or anti-tampering.

  • Context: Applications like Autodesk AutoCAD, SolidWorks, or specific Oracle Database client tools often bundle the AlexeySolodovnikov signed DLL as part of their installation or runtime protection layer. When these applications launch, they load this DLL, triggering the rule even though it is a known good component.
  • Filter/Exclusion: Add an exclusion for the specific file path and publisher.
    • Action: Exclude files where FilePublisher equals “Alexey Solodovnikov” AND FilePath contains \Program Files\Autodesk\ or \Program Files\SolidWorks\.

• Scenario: Scheduled maintenance jobs running ASProtect Server services on endpoint management servers.

  • Context: In environments using System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager, scheduled tasks often trigger background updates for protected software assets. These tasks invoke the ASProtect DLL to verify integrity before pushing updates, causing repeated alerts during maintenance windows (e.g., 02:00 – 04:00 AM).
  • Filter/Exclusion: Create a time-based exclusion combined with process lineage filtering.
    • Action: Exclude detections where ParentProcessName is ccmexec.exe or TaskHost.exe AND the event occurs between 02:00 and 04:00 local time on weekdays.

• Scenario: Deployment of new software via Group Policy or Intune that includes