EXE Manager 32

Hunt Hypothesis

This rule identifies potentially malicious or suspicious 32-bit executable files, which adversaries often use to execute payloads or establish persistence on legacy systems or specific application layers. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect low-severity indicators of compromise that may slip past standard behavioral detections, ensuring comprehensive coverage against targeted file-based attacks.

YARA Rule

rule EXE_Manager_32: PEiD
{
    strings:
        $a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 F6 0B 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BD 0A 00 B9 FB 05 2E 8B 1E 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 70 01 26 8C 0E 0E 00 BE 47 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT administrators deploy older 32-bit business applications (e.g., legacy ERP clients, specific CAD tools, or older versions of Adobe Acrobat Reader) to endpoints via Group Policy Object (GPO) software installation, the resulting .exe files may match the rule’s signature if they are not digitally signed or use older compiler versions.
  • Filter/Exclusion: Exclude paths under C:\Program Files (x86)\ for known legacy application directories (e.g., C:\Program Files (x86)\[LegacyApp]\) or whitelist specific file hashes for known legacy binaries.
• Driver and Utility Installation Packages: Many hardware drivers (e.g., NVIDIA, Intel, Realtek) and system utilities (e.g., 7-Zip, WinRAR, older versions of Java JRE) install 32-bit helper executables or installers in C:\Windows\SysWOW64\ or C:\Program Files (x86)\Common Files\. These are legitimate but often lack modern digital signatures or match generic 32-bit PE header characteristics.
  • Filter/Exclusion: Exclude files located in C:\Windows\SysWOW64\ and C:\Program Files (x86)\Common Files\ unless the parent process is an unknown or untrusted installer.
• Scheduled Maintenance Jobs (e.g., Disk Cleanup, Indexing Service): Windows built-in maintenance tasks such as cleanmgr.exe (Disk Cleanup), scandisk.exe, or older indexing service components run as 32-bit executables on 64-bit systems. These are frequently triggered by scheduled tasks during off-hours maintenance windows.
  • Filter/Exclusion: Whitelist specific system binaries like cleanmgr.exe, scandisk.exe, and `chkdsk