ExeSplitter13SplitCryptMethodBillPrisonerTPOC

Hunt Hypothesis

This detection identifies adversaries utilizing the ExeSplitter technique to split executable files and apply cryptographic methods for obfuscation, which often indicates an attempt to evade static analysis by fragmenting malicious payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel because these sophisticated splitting mechanisms can bypass traditional signature-based defenses, necessitating behavioral monitoring to uncover hidden execution chains before they compromise critical assets.

YARA Rule

rule ExeSplitter13SplitCryptMethodBillPrisonerTPOC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
	$a1 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 [4] 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 [7] 66 }

condition:
		$a0 or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ExeSplitter13SplitCryptMethodBillPrisonerTPOC detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The Office Click-to-Run update mechanism (OfficeClickToRun.exe) frequently splits large payload files into smaller chunks during installation or feature updates. These split files often utilize cryptographic signatures that match the “BillPrisoner” pattern within the YARA rule, triggering an alert when the service performs background maintenance.
  • Filter/Exclusion: Exclude processes where ProcessName equals OfficeClickToRun.exe and the parent process is Microsoft Office Click-to-Run Service. Additionally, filter out alerts occurring during standard business hours (08:00–17:00) if the file path contains \Program Files\Microsoft Office Root\Office16\.

• Scenario: Antivirus Real-Time Scanning of Split Archives

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or SentinelOne often decompress and split large .zip or .7z archives in the C:\Temp directory during real-time scanning. The splitting logic employed by these tools mimics the cryptographic method detected by the rule, causing false positives when users download large software installers.
  • Filter/Exclusion: Create a whitelist for file paths containing \AppData\Local\Temp\ or \Users\<Username>\Downloads\. Apply a filter to ignore alerts where the parent process is FalconService.exe (CrowdStrike) or SentinelOneAgent.exe, provided the file extension ends in .tmp or .split.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Automated