ExeTools COM2EXE additional

Hunt Hypothesis

This rule detects the presence of ExeTools COM2EXE, a utility frequently used by adversaries to convert COM objects into standalone executables for persistence or execution. Proactively hunting for this tool helps identify potential staging activities or post-exploitation actions where attackers are preparing payloads for deployment within the Azure Sentinel environment.

YARA Rule

rule ExeTools_COM2EXE_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or system administrator uses ExeTools to convert a legacy .com file (e.g., a small utility script or old BIOS update tool) into a .exe for compatibility with modern Windows environments.

  • Filter/Exclusion: Exclude alerts where the parent process is ExeTools.exe (or similar known GUI wrappers) and the destination file path ends in .exe within a user-writable directory (e.g., C:\Users\*\Desktop\ or C:\Temp\), provided the source file ends in .com.

• Scenario: An automated build pipeline or CI/CD agent (e.g., Jenkins, TeamCity, or Azure DevOps) executes a custom build step that uses ExeTools via command line to package a DOS-based component for distribution.

  • Filter/Exclusion: Exclude alerts where the parent process is a known CI/CD agent executable (e.g., java.exe running a Jenkins agent, dotnet.exe, or node.exe) and the working directory is within a designated build workspace (e.g., C:\Jenkins\workspace\ or C:\BuildAgent\).

• Scenario: A software installer or deployment tool (e.g., SCCM Client, PDQ Deploy, or Chocolatey) uses ExeTools as a helper utility to convert a .com payload during the installation of legacy enterprise applications.

  • Filter/Exclusion: Exclude alerts where the parent process is a known deployment or installer executable (e.g., ccmsetup.exe, pdqdeploy.exe, choco.exe) and the destination path is within a standard program files or temp installation directory (e.g., C:\Program Files (x86)\ or C:\Windows\Temp\).

• **Scenario