EXEManagerVersion301994cSolarDesigner

Hunt Hypothesis

This detection identifies the presence of a specific executable version associated with Solar Designer software, which may indicate legitimate application deployment or potential supply chain compromise if found in unexpected contexts. A proactive hunt is recommended to verify the legitimacy of this binary across the Azure Sentinel environment and ensure it aligns with known inventory baselines before any anomalous behavior escalates.

YARA Rule

rule EXEManagerVersion301994cSolarDesigner
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 1E 06 CD 21 2E [3] BF [2] B9 [2] 33 C0 2E [2] 47 E2 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the EXEManagerVersion301994cSolarDesigner YARA rule, along with recommended filters or exclusions:

• Scenario: Scheduled Solar Designer Backup Job

  • Context: The enterprise runs a nightly scheduled task (via Windows Task Scheduler) that launches solar-designer.exe to archive project files. This process often triggers the rule because it matches the specific version signature of the application during execution.
  • Filter/Exclusion: Create an exclusion based on the Process Name (solar-designer.exe) and Parent Process (TaskHost.exe or svchost.exe). Additionally, restrict the alert to only trigger if the process path is outside the standard installation directory (e.g., exclude paths starting with C:\Program Files\Solar Designer\bin\).

• Scenario: Microsoft Office Add-in Initialization

  • Context: Users frequently open Excel or PowerPoint files containing embedded Solar Designer components. When the add-in initializes, it spawns a background helper process that matches the YARA signature, even though no active design work is being performed by the user.
  • Filter/Exclusion: Implement a filter to suppress alerts where the Parent Process is EXCEL.EXE or POWERPNT.EXE. This ensures that add-in background activity does not generate high-volume noise during standard office hours.

• Scenario: Endpoint Antivirus On-Access Scanning

  • Context: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs real-time scanning on the Solar Designer installation directory. When the antivirus engine scans solar-designer.exe itself, the file access triggers the YARA rule as a potential new execution event.
  • Filter/Exclusion: Add an exclusion for processes where the **