← Back to SOC feed Coverage →

MetrowerksCodeWarriorv20GUI

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-14T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of legacy Metrowerks CodeWarrior v20 GUI tools within the environment, which may indicate outdated development assets or potential supply chain exposure in Azure Sentinel. Proactive hunting for this specific artifact is essential to assess whether these older components align with current security baselines and to mitigate risks associated with unmonitored legacy software that could serve as an entry point for adversaries.

YARA Rule

rule MetrowerksCodeWarriorv20GUI
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 [2] 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 [12] E8 [2] 00 00 E8 [2] 00 00 E8 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the MetrowerksCodeWarriorv20GUI detection rule in an enterprise environment, along with recommended filters:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar