diProtectorV1XdiProtectorSoftware

Hunt Hypothesis

This rule identifies the presence of diProtector, a software protection tool often used to obfuscate executables and hinder reverse engineering, which adversaries may leverage to hide malicious payloads. Proactively hunting for this indicator in Azure Sentinel allows the SOC to detect potential fileless or packed malware that could otherwise evade standard signature-based detections during initial access or execution phases.

YARA Rule

rule diProtectorV1XdiProtectorSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a local build pipeline or CI/CD agent (e.g., Jenkins, GitLab Runner, or Azure DevOps) that compiles C++ or C# applications using the diProtector software protection tool to obfuscate the resulting binaries for production deployment.
  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, java.exe for Jenkins) or where the command line contains arguments related to build tasks (e.g., /t:Build, --obfuscate).
• Scenario: An IT administrator performs a scheduled maintenance task using a custom PowerShell script or batch file that invokes diProtector.exe to re-protect or update the license keys of a proprietary internal application (e.g., a custom inventory management system) during a nightly maintenance window.
  • Filter/Exclusion: Exclude executions where the parent process is powershell.exe or cmd.exe and the working directory is within a known administrative maintenance folder (e.g., C:\Admin\Maintenance\ or C:\Scripts\) and the time of day falls within the defined maintenance window (e.g., 02:00–04:00).
• Scenario: A QA engineer manually tests the software protection feature by running diProtector.exe from a command prompt to generate test binaries for a new feature release, often from a temporary directory or a specific test folder.
  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe or powershell.exe and the current working directory matches a known test or QA path pattern (e.g., C:\QA\Tests\, C:\Temp\Builds\) or where the user belongs to a specific “QA Engineers” security