BeRoEXEPackerv100LZBRSBeRoFarbrausch

Hunt Hypothesis

This detection identifies the presence of a specific executable packed with the Farbrausch tool, which adversaries often employ to obscure malicious code and evade static analysis. Proactively hunting for this signature in Azure Sentinel is essential to uncover stealthy threats that may bypass traditional antivirus solutions by leveraging custom packing techniques.

YARA Rule

rule BeRoEXEPackerv100LZBRSBeRoFarbrausch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] BF [4] FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 [4] 72 03 A4 EB F2 E8 [4] 8D 51 FF E8 [4] 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the BeRoEXEPackerv100LZBRSBeRoFarbrausch detection rule, including targeted filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The OfficeC2RClient.exe process frequently triggers this YARA rule during scheduled background updates or when a user opens an application for the first time after an update. The rule detects the specific packing signature used by the Farbrausch installer within the Office deployment package.
  • Filter/Exclusion: Create a whitelist exclusion for the file path C:\Program Files\Microsoft Office\root\Office16\ and process name OfficeC2RClient.exe. Alternatively, add a condition to exclude events where the parent process is msiexec.exe or setup.exe running under the SYSTEM account.

• Scenario: Antivirus Definition Updates (e.g., CrowdStrike or SentinelOne)

  • Context: Endpoint Detection and Response (EDR) agents often download new definition packs that utilize similar executable packing structures. When the agent’s updater service (CrowdStrike Falcon Sensor or SentinelOne Agent) extracts a new module, it generates a process matching the Farbrausch signature logic.
  • Filter/Exclusion: Exclude processes with names containing FalconService.exe, S1Agent.exe, or ScanEngine.exe. Additionally, filter out events where the file hash matches known good hashes of the specific EDR vendor’s update components stored in a trusted allow-list database.

• Scenario: Scheduled Backup Jobs via Veeam or Acronis

  • Context: Enterprise backup solutions often use custom executable wrappers to manage data compression and encryption tasks. During nightly scheduled jobs, these tools spawn worker processes that match the `BeRoFarbra