EnigmaProtector10XSukhovVladimir

Hunt Hypothesis

This rule detects the presence of Enigma Protector 10x, a commercial software protection tool that can be leveraged by adversaries to obfuscate malicious payloads and hinder static analysis during initial access or execution phases. Proactively hunting for this indicator in Azure Sentinel helps identify potentially compromised endpoints or suspicious deployments where legitimate protection tools are misused to mask malicious activity within the environment.

YARA Rule

rule EnigmaProtector10XSukhovVladimir
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 [2] 81 ED [35] E8 01 00 00 00 ?? 83 C4 04 EB 02 [2] 60 E8 24 00 00 00 00 00 ?? EB 02 [2] 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 [2] 89 C4 61 EB 2E [7] EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 [2] 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer compiles a custom C++ application using the Enigma Protector 10X SDK to protect proprietary business logic or license keys before deployment to production servers.
  • Filter/Exclusion: Exclude files located in specific build directories (e.g., C:\Builds\, D:\CI\Artifacts\) or exclude processes initiated by known build tools like MSBuild.exe, dotnet.exe, or cmake.exe that are writing to these directories.
• Scenario: An IT administrator manually updates a legacy line-of-business application that uses Enigma Protector for code obfuscation, copying the updated .exe file from a network share to the local C:\Program Files\LegacyApp\ directory.
  • Filter/Exclusion: Exclude file creation events where the source path is a known network share (e.g., \\fileserver\apps\) and the destination path matches a standard application install directory (C:\Program Files\ or C:\Program Files (x86)\), specifically for users in the IT_Admins or App_Support security groups.
• Scenario: A scheduled maintenance job runs a custom script that re-encrypts or re-signs a critical service executable using the Enigma Protector CLI tool to apply a new license key or update the protection layer.
  • Filter/Exclusion: Exclude events where the parent process is a scheduled task runner (e.g., Svchost.exe with specific service names, or Taskschd.exe) and the command line arguments contain keywords like enigmaprotector, /license, or /update, targeting files in C:\Windows\System32\ or specific service directories.
• Scenario: A QA engineer tests a new release of a client application on a test bench machine,