Enigmaprotector112VladimirSukhov

Hunt Hypothesis

This rule targets the execution of Enigma Protector 11.2, a software protection tool frequently leveraged by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this indicator allows the SOC to identify potentially hidden or packed executables that may be staging further compromise within the Azure environment.

YARA Rule

rule Enigmaprotector112VladimirSukhov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED [35] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 [4] B8 [35] E8 01 00 00 00 9A 83 C4 04 01 E8 [31] E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 [31] E8 01 00 00 00 9A 83 C4 04 B9 44 1A }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin uses Enigma Protector to compile a custom internal utility or license generator that is then distributed via Microsoft Endpoint Configuration Manager (MECM) or Intune to a specific group of engineers. The binary retains the Enigma Protector header, triggering the YARA rule on the target hosts.
  • Filter/Exclusion: Exclude files where the parent process is CcmExec.exe (MECM client) or IntuneAgent.exe and the file path resides in a known application directory (e.g., C:\Program Files\InternalTools\).
• Scenario: A legacy line-of-business application (e.g., a custom inventory management system) is protected with Enigma Protector to prevent reverse engineering. The application is launched by a scheduled task defined in Windows Task Scheduler (schtasks.exe) or via a Service Control Manager service (services.exe) during nightly batch processing.
  • Filter/Exclusion: Exclude instances where the parent process is svchost.exe (specifically the LocalService or NetworkService account) or Task Scheduler service, and the file extension is .exe located in a dedicated LOB application folder (e.g., C:\Apps\InventorySystem\).
• Scenario: A security team or developer uses Enigma Protector to create a test binary for performance benchmarking or compatibility testing, which is executed directly from a temporary directory (e.g., C:\Users\<Admin>\AppData\Local\Temp\) by PowerShell (powershell.exe) or Command Prompt (cmd.exe) during a maintenance window.
  • Filter/Exclusion: Exclude files located in AppData\Local\Temp or C:\Temp where the parent process is powershell.exe or cmd.exe