ExeToolsCOM2EXE

Hunt Hypothesis

This rule identifies executable files that have been converted from COM objects to standard PE executables, a technique often used by adversaries to bypass file extension-based filtering or to obscure the true nature of a payload. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect low-severity persistence or execution mechanisms that may slip past traditional signature-based detections and reveal hidden malicious activity within the environment.

YARA Rule

rule ExeToolsCOM2EXE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5D 83 ED ?? 8C DA 2E 89 96 [2] 83 C2 ?? 8E DA 8E C2 2E 01 96 [2] 60 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT administrator manually converts a legacy .com file to .exe using the command-line interface of ExeTools (e.g., exetools.exe /c2e legacy_app.com) on a build server or developer workstation.
  • Filter/Exclusion: Exclude alerts where the parent process is cmd.exe or powershell.exe and the command line arguments contain specific ExeTools flags like /c2e or /e2c, or restrict the rule to non-interactive user sessions if the tool is primarily used for automation.
• Scenario: A scheduled maintenance job or CI/CD pipeline step uses ExeTools to batch-convert a directory of legacy DOS utilities before packaging them into a deployment artifact.
  • Filter/Exclusion: Exclude processes running under a service account (e.g., NT SERVICE\... or a dedicated svc-ci account) or exclude paths located within known CI/CD workspace directories (e.g., C:\Jenkins\workspace\, C:\AzureDevOps\).
• Scenario: A software vendor’s installer or setup script invokes ExeTools as part of a post-install configuration step to convert helper scripts or legacy components.
  • Filter/Exclusion: Correlate with the parent process name (e.g., setup.exe, install.exe, or a specific vendor’s installer binary) and exclude if the parent process signature is trusted or if the execution occurs within a known vendor installation directory.
• Scenario: A third-party backup or archiving utility that bundles ExeTools internally to normalize file formats before compression, running from a temporary extraction folder.
  • Filter/Exclusion: Exclude alerts where the executable path resides in a temporary directory (e.g., C:\Windows\Temp\, `C:\Users<user>\AppData