iPBProtectv013

Hunt Hypothesis

This YARA rule targets the iPBProtect v0.13 malware family, a known infostealer that often operates in the background to exfiltrate sensitive data such as browser credentials and cryptocurrency wallets. Proactively hunting for this signature allows the SOC team to identify compromised endpoints early, mitigating the risk of data leakage before the adversary establishes persistence or initiates data exfiltration.

YARA Rule

rule iPBProtectv013
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A security team deploys the iPBProtect agent (or a similar proprietary protection suite) via SCCM (System Center Configuration Manager) or Intune to a fleet of Windows endpoints. The installation package or the service binary (iPBProtectService.exe or similar) contains specific version strings or memory patterns that match the YARA rule’s signature, triggering alerts on every machine during the initial rollout or subsequent updates.

  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM) or IntuneAgent.exe, and the file path contains \iPBProtect\ or \iPBProtectService\. Additionally, whitelist the specific SHA-256 hash of the known-good iPBProtect binary version used in the enterprise.

• Scenario: An IT administrator runs a scheduled PowerShell script or Task Scheduler job to perform routine health checks or log rotation for the iPBProtect service. The script loads the iPBProtect DLLs into memory for inspection or uses rundll32.exe to invoke specific functions within the protection module, causing the YARA rule to match the loaded module in memory.

  • Filter/Exclusion: Exclude detections where the parent process is powershell.exe or cmd.exe and the command line contains keywords like iPBProtect, healthcheck, or logrotate. Ensure the exclusion applies only to non-interactive sessions (e.g., powershell.exe -NonInteractive).

• Scenario: A backup solution such as Veeam Backup & Replication or Commvault takes a snapshot of a virtual machine or physical host where the iPBProtect agent is installed. During the snapshot or backup process, the backup agent may temporarily load or scan the iPBProtect binaries or configuration files, causing the YARA rule