CopyProtectorv20

Hunt Hypothesis

This detection identifies potential file integrity protection mechanisms or anti-tampering behaviors triggered by the CopyProtectorv20 signature, which may indicate an adversary attempting to secure their tools against analysis or modification. Proactively hunting for this activity in Azure Sentinel allows the SOC team to distinguish between legitimate security controls and evasion tactics used by attackers to maintain persistence within the environment.

YARA Rule

rule CopyProtectorv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E A2 [2] 53 51 52 1E 06 B4 ?? 1E 0E 1F BA [2] CD 21 1F }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: CopyProtectorv20

• Scenario 1: Enterprise Backup Agent Snapshots

  • Context: The Veeam Backup & Replication agent (or similar tools like Commvault) periodically creates memory-mapped file copies or temporary shadow copies of active user documents during scheduled backup windows. These operations often involve high-volume file I/O that mimics the behavior of a copy-protecting malware.
  • Suggested Filter: Exclude processes matching VeeamBackupService.exe, vbragent.exe, and commvault_agent.exe running under the system account (NT SYSTEM) or specific backup service accounts during defined maintenance windows (e.g., 02:00–06:00).

• Scenario 2: Scheduled Document Conversion Jobs

  • Context: An automated nightly job using Microsoft Word Interop or Adobe Acrobat Pro runs on a file server to convert legacy .doc files to PDF for archival. This process involves reading source files and writing new protected versions, triggering the “copy protection” signature.
  • Suggested Filter: Create an exclusion for WINWORD.EXE and AcroRdr64.exe when executed by a specific scheduled task account (e.g., svc_doc_conversion) on hostnames matching the pattern *FILE-SRV-*.

• Scenario 3: Endpoint DLP Policy Enforcement

  • Context: Symantec Data Loss Prevention (DLP) or Microsoft Purview Information Protection agents actively scan and apply rights management labels to files as they are copied to network shares. The act of applying encryption tags often triggers the YARA rule’s logic regarding file integrity checks.
  • Suggested Filter: Exclude events where the parent process is SymantecDLP.exe or MSPurviewAgent.exe