EEXEVersion112

Hunt Hypothesis

This detection identifies potential execution of legacy or unverified executable versions that may indicate an adversary attempting to leverage outdated software for initial access or lateral movement. Proactively hunting for these instances in Azure Sentinel allows the SOC team to assess whether these low-severity executions represent benign administrative activity or early-stage indicators of a stealthy threat exploiting known version vulnerabilities.

YARA Rule

rule EEXEVersion112
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the EEXEVersion112 detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Microsoft Office Updates via Click-to-Run Service

  • Context: The OfficeClickToRun.exe process (Microsoft Office Update Service) frequently executes version 11.2.x binaries during its daily maintenance window to patch the Office suite. This triggers the YARA rule as it scans and installs new executable versions matching the rule’s signature.
  • Filter/Exclusion: Create a whitelist exclusion for the specific process path C:\Program Files\Microsoft Office\root\Office16\OfficeClickToRun.exe or filter events where the parent process is svchost.exe running under the “Microsoft Office” service account during business hours (09:00–17:00).

• Scenario: Automated Antivirus Definition Updates

  • Context: Enterprise endpoint protection agents like CrowdStrike Falcon or Symantec Endpoint Protection run scheduled jobs to download and install new definition signatures. These updates often involve extracting versioned executables (e.g., C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.x.x\mpengine.dll) that match the EEXEVersion112 signature pattern.
  • Filter/Exclusion: Exclude events where the file hash matches known good hashes for the specific AV vendor’s update engine, or filter by process name MpCmdRun.exe (Windows Defender) and Csfalcon.exe (CrowdStrike).

• Scenario: Deployment of Internal Line-of-Business Applications via SCCM/Intune

  • Context: IT administrators use Microsoft Endpoint Configuration Manager (SCCM) or Intune to push internal applications. During the “Install” phase,