EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin

Hunt Hypothesis

This detection identifies the presence of a specific Enigma Protector 131 build DLL, which is frequently embedded in legitimate software but also utilized by adversaries to obfuscate malicious payloads and evade static analysis. A proactive hunt for this indicator within Azure Sentinel is essential to distinguish between benign application usage and potential supply chain compromises or fileless attacks leveraging this known packing mechanism.

YARA Rule

rule EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED [4] E9 49 00 00 00 [40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 [4] FF E0 E9 04 00 00 00 [4] B8 [4] 03 C5 81 C0 [4] B9 [4] BA [4] 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin detection rule, tailored for a legitimate enterprise environment:

• Legacy ERP Module Deployment in Finance Department

  • Scenario: The Finance team deploys an older version of the “SAP NetWeaver” add-on module which utilizes the Enigma Protector 13.1 runtime (Build 2007) for license enforcement and anti-tampering on a critical payroll calculation DLL. This occurs during the monthly end-of-month processing window.
  • Filter/Exclusion: Create an exclusion based on the specific file path C:\Program Files\SAP\NetWeaver\AddOns\Payroll.dll and restrict the rule trigger to the “Finance-Prod” Active Directory Organizational Unit (OU) during the execution of the scheduled job “Monthly_Payroll_Calc”.

• Endpoint Protection Agent Update via SCCM

  • Scenario: The IT Operations team pushes a silent update for the legacy “Symantec Endpoint Protection” agent using Microsoft System Center Configuration Manager (SCCM). The installer package includes an Enigma-protected wrapper DLL used to verify the integrity of the driver installation on workstations.
  • Filter/Exclusion: Exclude processes spawned by ccmsetup.exe and wuauserv.exe (Windows Update) where the file hash matches the known good signature of the Symantec update package, specifically filtering out events occurring between 02:00 and 04:00 UTC.

• Third-Party Digital Rights Management (DRM) for Training Portal

  • Scenario: The Learning & Development team runs a proprietary e-learning portal hosted on-premise. The client application uses the Enigma Protector