DIETv100d

Hunt Hypothesis

This rule detects the presence of the DIETv100d YARA signature, which typically identifies specific malicious payloads or obfuscated code patterns associated with known threat actor tooling. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify dormant or low-noise implants that may have evaded traditional behavioral detections, ensuring early containment of targeted intrusions.

YARA Rule

rule DIETv100d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 06 1E 0E 8C C8 01 [3] BA [2] 03 [14] 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A software vendor’s installer or updater (e.g., Adobe Creative Cloud, JetBrains Toolbox, or VMware Workstation) downloads or extracts a self-contained runtime or helper binary that matches the DIETv100d signature. This often occurs during silent updates or when a portable version of a tool is deployed via Group Policy.

  • Filter/Exclusion: Exclude files located in vendor-specific installation directories (e.g., C:\Program Files\Adobe\, C:\Program Files\JetBrains\) or exclude processes where the parent process is a known installer service (e.g., msiexec.exe, setup.exe) and the file path contains temp or cache subdirectories associated with the vendor.

• Scenario: A developer or DevOps engineer runs a local Docker container or Podman image that includes a lightweight Linux userland (e.g., Alpine-based images) which contains a statically linked binary matching the DIETv100d pattern. This is common in CI/CD pipelines or local development environments where containers are run on Windows hosts using WSL2 or Docker Desktop.

  • Filter/Exclusion: Exclude files whose path contains docker, podman, wsl, or containerd directories (e.g., C:\Users\<user>\AppData\Local\Docker\, C:\ProgramData\containerd\). Additionally, exclude if the process tree includes dockerd.exe or wsl.exe as an ancestor.

• Scenario: A Python or Node.js application bundles a native C/C++ extension module (e.g., numpy, scipy, or sharp) that is compiled with specific optimizations or includes a small runtime library matching the DIETv100d signature. This is