ExeLockv100

Hunt Hypothesis

This rule detects the presence of ExeLock, a file locking utility often used by adversaries to prevent security tools or cleanup scripts from modifying or deleting critical executables. Proactively hunting for this artifact in Azure Sentinel helps identify potential defense evasion tactics where attackers are attempting to lock files to hinder incident response or forensic analysis.

YARA Rule

rule ExeLockv100
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 8C C8 8E C0 BE [2] 26 [2] 34 ?? 26 [2] 46 81 [3] 75 ?? 40 B3 ?? B3 ?? F3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Antivirus/EDR Real-Time Scanning: When an endpoint protection agent (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or Carbon Black) opens an executable file to scan its contents, it may temporarily lock the file handle or hold an exclusive lock during the hash calculation and signature matching process.
  • Filter/Exclusion: Exclude processes where the parent process name matches known AV/EDR service executables (e.g., MsMpEng.exe, FalconSensor.exe, CbService.exe) or exclude events where the locking process belongs to the “Security” or “Antivirus” service group.
• Windows Update Service (WU) Installation: During the installation of Windows Updates or feature updates, the TiWorker.exe (Windows Update) or svchost.exe (hosting the WUA service) process locks .exe files in the C:\Windows\Installer or C:\Windows\Temp directories to prevent modification while extracting or applying patches.
  • Filter/Exclusion: Exclude locking processes named TiWorker.exe or svchost.exe where the service name is wuauserv (Windows Update) or WSearch (if related to indexing locks), and restrict the file path to C:\Windows\ or C:\Program Files\.
• Software Deployment via SCCM/Intune: When System Center Configuration Manager (SCCM) or Microsoft Intune deploys new software, the ccmsetup.exe or IntuneAgent.exe process locks the installer executable or the target application binary while copying files to the destination directory or registering COM components.
  • Filter/Exclusion: Exclude processes named ccmsetup.exe, ccmexec.exe, or IntuneAgent.exe, and consider excluding file paths under C:\Windows\CCM