MSLRHv032afakePEX099emadicius

Hunt Hypothesis

This detection identifies potential adversary activity involving the execution of suspicious processes matching the specific “fakePEX099emadicius” YARA signature, which may indicate early-stage reconnaissance or the deployment of a custom malicious payload. SOC teams should proactively hunt for this indicator in Azure Sentinel to validate its legitimacy and uncover stealthy threats that might evade standard heuristic detections due to their low severity classification.

YARA Rule

rule MSLRHv032afakePEX099emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the MSLRHv032afakePEX099emadicius YARA rule, along with recommended filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Endpoint Protection Scans

  • Context: Enterprise antivirus solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently generate temporary PE (Portable Executable) files in memory during real-time scanning or on-demand deep scans. These tools often inject code that mimics the structural characteristics of the “fakePE” signature defined in this rule, triggering alerts when no actual malware is present.
  • Filter/Exclusion: Exclude processes where the ImageName matches known AV binaries (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Windows\System32\mpcmdrun.exe) and the parent process is a scheduled maintenance task or the AV service itself.

• Scenario: Software Deployment via Configuration Management

  • Context: During mass software deployments using tools like Microsoft SCCM (Configuration Manager), Ivanti, or Ansible, agents create temporary executable wrappers to distribute application packages. These wrappers often utilize custom PE headers that the YARA rule interprets as suspicious “fake” structures, particularly when deploying updates to legacy applications.
  • Filter/Exclusion: Create an exclusion for events where the ParentImageName contains known deployment agents (e.g., ccmsetup.exe, IvantiAgent.exe) and the file path resides within a temporary distribution folder (e.g., paths containing \Distribution\ or \Temp\).

• Scenario: Scheduled PowerShell Script Execution

  • Context: IT administrators frequently run scheduled maintenance scripts using PowerShell (powershell.exe) that