FSGv110EngdulekxtMicrosoftVisualC60ASM

Hunt Hypothesis

This detection identifies potential adversary activity involving the execution of Microsoft Visual C++ 6.0 assemblies that may indicate legacy software exploitation or supply chain compromise within the environment. A proactive hunt is essential to validate these low-severity signals and uncover hidden threats that could leverage outdated runtime components for initial access or lateral movement in Azure Sentinel.

YARA Rule

rule FSGv110EngdulekxtMicrosoftVisualC60ASM
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B [2] FB C1 C1 03 33 F7 EB 02 CD 20 68 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv110EngdulekxtMicrosoftVisualC60ASM detection rule, which targets Microsoft Visual C++ 6.0 Assembly Module files often found in legacy application environments:

• Scenario: Legacy ERP System Patching via Scheduled Task

  • Context: A nightly maintenance window triggers a scheduled task on the SQL Server or SAP NetWeaver server to update a legacy module. The process invokes msiexec.exe which extracts and executes the Visual C++ 6.0 assembly file (MSVCP60.dll or similar) as part of the deployment pipeline.
  • Filter/Exclusion: Create an exclusion based on the parent process name TaskScheduler.exe (or schtasks) running under the SYSTEM account, specifically targeting paths within the application’s installation directory (e.g., C:\Program Files\SAP\FrontEnd\).

• Scenario: Automated Build Pipeline Execution in DevOps

  • Context: A CI/CD pipeline using Jenkins or Azure DevOps Agents compiles a legacy .NET Framework application. The build agent runs the MSBuild tool, which loads the Visual C++ 6.0 runtime library to resolve dependencies for older DLLs during the compilation phase.
  • Filter/Exclusion: Exclude events where the parent process is msbuild.exe or dotnet.exe, and the file path resides within a known build workspace directory (e.g., D:\BuildAgent\Workspaces\LegacyApp\).

• Scenario: Endpoint Protection Scanning of Legacy Archives

  • Context: The enterprise endpoint protection suite, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the file system. During this scan, it unpack