ExeSplitter12BillPrisonerTPOC

Hunt Hypothesis

This detection identifies adversary activity where malicious executables split or reassemble payloads to evade static analysis and bypass traditional signature-based defenses. Proactively hunting for this behavior in Azure Sentinel is critical to uncover sophisticated file manipulation tactics that may indicate early-stage lateral movement or command-and-control establishment before full compromise occurs.

YARA Rule

rule ExeSplitter12BillPrisonerTPOC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ExeSplitter12BillPrisonerTPOC rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Self-Repair

  • Context: The Office Click-to-Run service (OfficeClickToRun.exe) periodically performs self-repairs or updates by splitting large installation packages into smaller executable chunks. This process often mimics the behavior of an “exe splitter” malware family, triggering the YARA rule when new temporary executables are spawned in C:\Program Files\Microsoft Office.
  • Suggested Filter: Exclude processes where the parent image path contains \Microsoft Office and the child process name matches OfficeClickToRun.exe or setup.exe, provided the file hash is signed by Microsoft Corporation.

• Scenario: Windows Defender Antivirus Real-Time Scanning

  • Context: During scheduled deep scans, Windows Defender (MsMpEng.exe) may extract and analyze compressed archives containing executables. If the malware signature involves unpacking a payload that resembles the “BillPrisoner” pattern (common in archive-based delivery), the scanner’s temporary extraction folder activity can trigger this rule.
  • Suggested Filter: Create an exclusion for any process spawned by MsMpEng.exe where the working directory is located within %ProgramData%\Microsoft\Windows Defender\Scans.

• Scenario: SCCM (Configuration Manager) Software Deployment

  • Context: System Center Configuration Manager often uses a custom deployment agent (ccmexec.exe) to distribute software. When deploying large applications, the agent frequently splits installation binaries into smaller segments for bandwidth optimization before execution. This segmentation logic aligns with the “ExeSplitter” detection logic.
  • Suggested Filter: Exclude alerts where the parent process is ccmexec.exe and the