MaskPE 16 yzkzero

Hunt Hypothesis

This rule identifies the presence of the MaskPE 16 yzkzero YARA signature, which typically indicates the use of a specific obfuscation or packing technique to hide malicious payloads from static analysis. Proactively hunting for this pattern in Azure Sentinel allows the SOC to detect low-severity, stealthy file manipulations that adversaries may employ to bypass initial security controls before executing their intended actions.

YARA Rule

rule MaskPE_16_yzkzero: PEiD
{
    strings:
        $a = { 36 81 2C 24 ?? ?? ?? 00 C3 60 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy 16-bit Application Deployment via Windows Installer: When deploying legacy 16-bit applications (e.g., old accounting software or specialized industrial control tools) using msiexec or setup.exe on Windows 10/11, the installer may extract or create temporary PE files that retain legacy headers or specific byte patterns matching the yzkzero signature.
  • Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or setup.exe and the file path contains \Temp\ or \AppData\Local\Temp\ with a .tmp or .msi extension.
• Scheduled Backup Job Creating Temporary PE Snapshots: Enterprise backup solutions (e.g., Veeam, Commvault) or disk imaging tools sometimes create temporary PE-based container files or snapshot artifacts during incremental backups. If these files are not fully stripped of debug or legacy sections, they can match the MaskPE signature.
  • Filter/Exclusion: Exclude files located in standard backup scratch directories (e.g., C:\ProgramData\Veeam\Backup\, C:\Commvault\Content\) and exclude processes initiated by backup service executables (e.g., vbrsrvr.exe, cvsvc.exe).
• Development Environment: Cross-Compilation or Emulation Tools: Developers using cross-compilers (e.g., MinGW, Wine) or emulators (e.g., QEMU, DOSBox) to build or run 16-bit Windows binaries may generate intermediate PE files that contain zeroed sections or legacy header structures.
  • Filter/Exclusion: Exclude files in developer workspace directories (e.g., C:\Users\<dev>\source\, C:\Projects\) and exclude processes associated with known development tools (e.g., gcc.exe, wine64.exe, `