EXEStealthv274WebToolMaster

Hunt Hypothesis

This detection identifies the execution of the EXEStealthv274 Web Tool Master utility, which adversaries may leverage to establish persistence or execute web-based reconnaissance tools on compromised hosts. SOC teams should proactively hunt for this activity in Azure Sentinel to validate legitimate administrative usage and distinguish it from potential stealthy command-and-control operations that could evade standard signature-based defenses.

YARA Rule

rule EXEStealthv274WebToolMaster
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 EB 17 [23] 60 90 E8 00 00 00 00 5D }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the EXEStealthv274WebToolMaster detection rule, along with recommended filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Service Updates

  • Context: The OfficeClickToRun.exe process frequently spawns child processes or modifies registry keys to update the Office suite. This behavior often mimics the “web tool master” signature by creating temporary executable artifacts in the %ProgramFiles%\Microsoft Office\root\Office16 directory that match the YARA strings for web-based deployment tools.
  • Filter/Exclusion: Exclude processes where ProcessName is OfficeClickToRun.exe and the file path contains \Microsoft Office\. Additionally, filter out events occurring during the standard maintenance window (e.g., 02:00–04:00 AM) if the rule triggers on scheduled update tasks.

• Scenario: Chrome Enterprise Auto-Update Mechanism

  • Context: In an enterprise environment using Google Chrome with managed policies, the GoogleUpdate.exe process runs as a background service to check for and install browser updates. It often launches a temporary web-based installer component that executes from the C:\Program Files (x86)\Google\Update directory, triggering the rule due to its network-facing executable nature.
  • Filter/Exclusion: Create an exclusion based on the parent process ID (PPID) belonging to GoogleUpdate.exe. Alternatively, filter out any detection where the file path starts with C:\Program Files (x86)\Google\ and the hash matches known good versions of the update agent.

• Scenario: Scheduled PowerShell Script for Web Portal Maintenance

  • Context: IT administrators often schedule a nightly PowerShell script (WebMaintenance.ps1) to clear cache files or sync data with an internal web portal