MSLRHv032afakePECompact14xemadicius

Hunt Hypothesis

This rule detects the presence of a compact, fake PE file structure often used by adversaries to obfuscate malicious payloads or evade static analysis during initial access or execution. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify low-severity, stealthy implants that may be staging for further compromise before they trigger more obvious behavioral alerts.

YARA Rule

rule MSLRHv032afakePECompact14xemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Scenario: A developer or DevOps engineer uses a lightweight, open-source PE packing tool (such as UPX or a custom Go-based packer) to compress a small utility binary (e.g., a 14-byte header stub or a compact CLI tool) to reduce deployment size in a CI/CD pipeline. The resulting binary retains the “fake PE” structure or compact header that the YARA rule targets.

  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\BuildAgent\artifacts\) or exclude binaries with a file size < 50KB that are executed by known CI/CD service accounts (e.g., svc-ci-runner).

• Legitimate Scenario: An endpoint protection agent (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) creates a temporary “compact” PE stub or shim during a real-time scanning or remediation action, which may briefly exist on disk with a non-standard PE header structure before being cleaned up.

  • Filter/Exclusion: Exclude processes or files created by known EDR service executables (e.g., FalconSensor.exe, cb.exe, SentinelOne.exe) or files in the EDR’s temporary working directory (e.g., C:\ProgramData\CrowdStrike\).

• Legitimate Scenario: A scheduled maintenance job runs a custom internal utility written in Rust or Go that uses a minimal PE header for fast loading in a microservice architecture. The binary is intentionally stripped of standard PE sections to optimize memory usage, triggering the “fake PE” or “compact” signature.

  • Filter/Exclusion: Exclude binaries with a specific hash (SHA256) or exclude files in the application’s bin directory (e.g., C:\Apps\InternalTools\bin\) that are executed by a