DzAPatcherv13Loader

Hunt Hypothesis

This rule detects the execution of the DzAPatcherv13Loader, a known loader component often used to establish initial footholds or facilitate further payload delivery in Azure environments. Proactively hunting for this specific loader allows the SOC team to identify early-stage compromise attempts and potential lateral movement vectors before they escalate into more complex post-exploitation activities.

YARA Rule

rule DzAPatcherv13Loader
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Patching via Custom Scripts: An IT operations team deploys a custom PowerShell or Batch script to apply security patches to a legacy, non-standard application (e.g., an older version of Adobe Acrobat or a specific ERP module) that lacks native auto-update capabilities. The script downloads the patch binary to a temporary directory (e.g., C:\Temp\ or %USERPROFILE%\AppData\Local\Temp\) and executes it directly, triggering the loader behavior.

  • Filter/Exclusion: Exclude execution from known temporary directories (C:\Temp, %TEMP%, C:\Windows\Temp) when the parent process is a recognized scripting host (powershell.exe, cmd.exe, wscript.exe) and the file path matches a known application patch folder structure (e.g., *Adobe*, *ERP*, *LegacyApp*).

• Scheduled Maintenance Jobs for Third-Party Tools: A scheduled task (e.g., Task Scheduler job) runs a maintenance script for a third-party tool like Nagios, Zabbix, or Ansible that downloads and executes a small updater binary or configuration sync tool in a user-specific or system temp location. The binary is signed but may not be in the default trusted path list, causing the YARA rule to flag the loader component.

  • Filter/Exclusion: Exclude processes spawned by schtasks.exe or Task Scheduler service (taskschd.msi) where the executable name matches known maintenance tools (e.g., nagios.exe, zabbix_agent2.exe, ansible-playbook.exe) and the parent process is svchost.exe (specifically the Task Scheduler service).

• Developer Local Testing with Portable Binaries: A developer tests a new microservice or utility by downloading a portable executable (e.g., curl,