ExeSplitter13SplitMethodBillPrisonerTPOC

Hunt Hypothesis

This detection identifies adversaries utilizing the ExeSplitter13 split method to fragment executable files, a technique often employed by malware like Bill Prisoner TPOC to evade signature-based scanning and obscure malicious payloads within legitimate processes. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy execution patterns that may bypass traditional antivirus solutions, ensuring early identification of file-splitting tactics used during the initial stages of an attack chain.

YARA Rule

rule ExeSplitter13SplitMethodBillPrisonerTPOC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 [4] 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D [4] 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC }
	$a1 = { E9 FE 01 00 00 [7] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3 }

condition:
		$a0 or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ExeSplitter13SplitMethodBillPrisonerTPOC detection rule, including suggested filters and exclusions:

• Scenario: Legitimate deployment of Microsoft Defender Antivirus (MDE) updates via Windows Update.

  • Context: The MDE engine frequently splits its update payload into multiple executable chunks during the installation phase to optimize memory usage, mimicking the “split method” behavior detected by the rule.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is usoc.exe (Update Orchestrator) or wuauserv.exe and the file path contains \Program Files\Windows Defender\.

• Scenario: Scheduled execution of Sysinternals Process Explorer or Process Monitor in “Split View” mode.

  • Context: Security analysts often run these tools to debug application behavior, which triggers internal splitting logic when analyzing large process trees or memory dumps, causing the YARA rule to match the tool’s own binary structure.
  • Suggested Filter/Exclusion: Create an exclusion for file paths containing \Sysinternals\ and specific executable names: procexp.exe, procmon.exe, and psexec.exe.

• Scenario: Automated backup jobs running via Veeam Backup & Replication or Acronis Cyber Protect.

  • Context: During the “bill” or reporting phase of a backup cycle, these agents often split large log files or configuration manifests into temporary executable wrappers before archiving them.
  • Suggested Filter/Exclusion: Exclude processes running under service accounts (e.g., VeeamBackupService, AcronisAgent) where the command line arguments include keywords like --split-method or --bill-prisoner.