This detection identifies unregistered instances of the EnigmaProtector110 security application, which may indicate unauthorized software deployment or a potential evasion tactic by an adversary bypassing standard inventory controls. Proactively hunting for this anomaly in Azure Sentinel allows the SOC team to validate legitimate installations and rapidly isolate unknown endpoints that could serve as vectors for lateral movement or data exfiltration.
rule Enigmaprotector110unregistered
{
meta:
author="malware-lu"
strings:
$a0 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
$a1 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35 }
condition:
$a0 or $a1
}This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the Enigmaprotector110unregistered detection rule, along with recommended filters or exclusions:
Scenario: An automated backup agent (e.g., Veeam Backup & Replication) launches a temporary helper process to scan and encrypt file metadata on a domain controller. The YARA rule flags this because the specific helper executable lacks the expected digital signature chain registered in the Enigma protector database, triggering an “unregistered” alert.
VeeamAgent.exe) or exclude the entire backup service account (DOMAIN\VeeamServiceAccount) from this rule when running on Domain Controllers.Scenario: A System Administrator performs an offline patch deployment using Microsoft Endpoint Configuration Manager (SCCM). During the installation of a new security update, the SCCM client creates a temporary staging folder containing unsigned installer scripts that are executed by ccmexec.exe. The rule interprets these transient scripts as unregistered Enigma components.
C:\Program Files (x86)\Microsoft Configuration Manager\ccmexec.exe) and limit the detection window to exclude alerts occurring during known maintenance windows (e.g., 02:00–04:00 UTC).Scenario: A scheduled PowerShell job runs nightly to archive logs from a legacy application. The script invokes an internal, custom-built utility tool that was recently updated but not yet propagated to the central Enigma registry database. This results in a high volume of alerts for every file processed by the custom tool.