MSLRHv031a

Hunt Hypothesis

This detection identifies specific file artifacts matching the MSLRHv031a YARA signature to uncover potential low-severity indicators of adversary activity that may not trigger standard alerts. Proactively hunting for this pattern in Azure Sentinel allows the SOC team to validate these subtle signals early, ensuring they can distinguish between benign noise and emerging threats before they escalate into significant incidents.

YARA Rule

rule MSLRHv031a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
	$a1 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }

condition:
		$a0 or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the MSLRHv031a detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Microsoft Defender Antivirus (MSE) Self-Protection Updates

  • Context: The YARA rule may flag the MsMpSvc.exe process when it downloads or installs definition updates. This often triggers because the update engine loads dynamic libraries that match the signature patterns of the MSLRHv031a logic, specifically during the “Engine Update” phase.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name MsMpSvc.exe and restrict it to the Parent Process svchost.exe. Additionally, exclude file paths containing \Program Files\Windows Defender\MpClient.dll.

• Scenario: Scheduled PowerShell Script for Compliance Reporting

  • Context: A nightly scheduled task (Task Scheduler) executes a custom PowerShell script (ComplianceReport.ps1) that queries the registry and enumerates running processes. The script utilizes System.Management.Automation modules which generate memory patterns indistinguishable from the MSLRHv031a signature, causing repeated alerts at 02:00 AM.
  • Filter/Exclusion: Implement an exclusion for the User Account DOMAIN\ComplianceServiceAccount. Alternatively, add a condition to ignore events where the Command Line argument contains -ExecutionPolicy Bypass and the script path is located within \Scripts\Compliance\.

• Scenario: Office 365 Click-to-Run (C2R) Update Service

  • Context: The Microsoft Office background update service (OfficeClickToRun.exe) frequently spawns child processes to patch Excel or Word components. These processes often load specific DLLs that trigger the MSLRHv0