MSLRHv032afakeMSVC60DLLemadicius

Hunt Hypothesis

This rule detects the presence of a fake MSVC60 DLL file, a common technique used by adversaries to masquerade malicious code as a legitimate Microsoft Visual C++ runtime component to evade detection. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify potential supply chain compromises or fileless malware staging activities before they progress to execution or lateral movement.

YARA Rule

rule MSLRHv032afakeMSVC60DLLemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy line-of-business application (e.g., a custom C++ tool from the early 2000s) is deployed via Group Policy or a configuration management tool like SCCM/Intune. The installer or the application binary itself may be statically linked or contain a specific resource structure that matches the YARA pattern for “fake MSVC60 DLLs,” particularly if the developer used a non-standard build process or a specific version of the Microsoft Visual C++ 6.0 compiler that left unique artifacts in the PE header or resource section.

  • Filter/Exclusion: Exclude paths where the file resides in known application directories such as C:\Program Files\LegacyApp\ or C:\Program Files (x86)\LegacyApp\. Additionally, exclude files with a specific hash (SHA256) if the application is consistently deployed from a trusted source, or exclude based on the parent process being a known installer service like msiexec.exe or ccmsetup.exe.

• Scenario: An enterprise antivirus or endpoint detection solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) creates a temporary copy or quarantine archive of a known good binary during a full system scan or a scheduled integrity check. If the EDR agent copies a legitimate DLL that was originally built with MSVC 6.0 to a temporary folder (e.g., C:\ProgramData\Temp\ or the EDR-specific cache directory) for analysis or backup, the YARA rule may trigger on this temporary file.

  • Filter/Exclusion: Exclude files located in standard temporary or cache directories associated with EDR agents, such as C:\ProgramData\CrowdStrike\, C:\ProgramData\Microsoft\Defender\, or C:\Windows\Temp\. You can also filter based on the parent process being the E