This rule identifies the presence of the EXEStealth malware family, a known threat actor tool used for initial access and persistence on Windows endpoints. Proactively hunting for this signature in Azure Sentinel allows the SOC to detect compromised hosts early, enabling rapid isolation before the adversary leverages the malware for lateral movement or data exfiltration.
rule EXEStealthv25
{
meta:
author="malware-lu"
strings:
$a0 = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
condition:
$a0
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: Execution of the Sysinternals PsExec.exe utility by an IT administrator to perform remote service management or registry editing on domain controllers. The binary often contains specific string patterns or section characteristics that match the EXEStealthv25 heuristic, triggering a false positive when run from the standard C:\Windows\Temp or C:\Sysinternals directories.
C:\Sysinternals\PsExec.exe or C:\Windows\Temp\PsExec.exe AND the parent process is services.exe or svchost.exe.Scenario: Deployment of Microsoft Defender for Endpoint or CrowdStrike Falcon agent updates via Group Policy or SCCM. The installer or update service (MpCmdRun.exe or FalconService.exe) may drop temporary executables or modify PE headers in a way that aligns with the stealth detection logic, particularly during the brief window of file replacement.
MpCmdRun.exe, FalconService.exe, or ccSvcHst.exe (CrowdStrike) AND the file path resides within C:\Program Files\Microsoft Security Client\ or C:\Program Files\CrowdStrike\.Scenario: Execution of VMware Tools or Hyper-V Integration Services update tasks on virtual machines. These tools frequently execute small helper executables from C:\Program Files\VMware\VMware Tools\ or C:\Windows\System32\drivers\ to synchronize time, clipboard, or network settings, which can exhibit “stealth” characteristics due to their minimal footprint and lack of standard version information.