FSGv110EngdulekxtMicrosoftVisualC5060

Hunt Hypothesis

This rule identifies files compiled with Microsoft Visual C++ 5.060, a legacy compiler version frequently exploited by threat actors to create stealthy payloads that evade modern static analysis tools. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to uncover dormant or low-and-slow malware implants that may have been overlooked by standard signature-based detections due to their outdated build characteristics.

YARA Rule

rule FSGv110EngdulekxtMicrosoftVisualC5060
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 [3] EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Framework Application Deployment: Enterprise applications built with older versions of Visual C++ (pre-2015/2017) often link against the vcruntime140.dll or similar runtime libraries. When IT departments deploy these legacy line-of-business applications via Group Policy or SCCM, the binary may contain specific string patterns or section structures that match the YARA rule.

  • Filter/Exclusion: Exclude binaries located in standard Program Files directories that are signed by trusted Microsoft or known vendor certificates, or specifically exclude files matching *.dll or *.exe within application-specific folders (e.g., C:\Program Files\LegacyApp\) if the rule targets specific version strings.

• Visual Studio Build Artifacts in Developer Environments: Developers compiling C++ projects using Visual Studio 2019 or 2022 may generate intermediate object files or debug binaries that retain specific compiler metadata or debug symbols. If the YARA rule inspects for specific compiler version strings or section names (e.g., .rdata or .text patterns), these legitimate build outputs can trigger alerts during local development or CI/CD pipeline executions on developer workstations.

  • Filter/Exclusion: Exclude processes or files originating from C:\Users\<User>\AppData\Local\Temp\ or C:\Users\<User>\Documents\Visual Studio\ paths, or filter based on the parent process being devenv.exe (Visual Studio IDE) or msbuild.exe.

• Third-Party SDKs and Runtime Libraries: Many enterprise software vendors bundle their own versions of the Microsoft Visual C++ Redistributable packages or custom-compiled C++ libraries within their installers. When these are installed on servers or workstations, the resulting DLLs may contain specific linker stamps or version information that coincidentally matches the YARA