Noodlecrypt2rsc

Hunt Hypothesis

This detection identifies potential ransomware activity by monitoring for specific file execution patterns associated with the Noodlecrypt2rsc variant using a targeted YARA signature. Proactive hunting in Azure Sentinel is essential to identify early-stage infections before encryption spreads, allowing the SOC team to isolate affected assets and mitigate low-severity threats that may escalate rapidly if left unaddressed.

YARA Rule

rule Noodlecrypt2rsc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 76 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Noodlecrypt2rsc detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Real-Time Scanning of Compressed Archives

  • Context: The YARA rule detects encryption-like behavior when the Windows Defender engine scans large .zip or .7z archives containing mixed file types (e.g., office documents, images) during real-time monitoring. The heuristic signature mimics ransomware activity as it iterates through encrypted blocks within the archive.
  • Filter/Exclusion: Exclude processes MsMpEng.exe and SenseService.exe from triggering this rule when the target file extension is .zip, .7z, or .rar. Additionally, add a condition to ignore alerts where the process command line contains arguments related to “Archive” or “Scan”.

• Scenario: Scheduled Backup Job Executing via Veeam Agent

  • Context: A nightly scheduled task runs VeeamAgent.exe which compresses and encrypts local user data before uploading to a cloud repository. The rule flags the rapid creation of encrypted temporary files in the backup staging folder as potential ransomware encryption activity.
  • Filter/Exclusion: Create an exclusion for the specific service account running the job (e.g., NT SERVICE\VeeamBackupService) and restrict the scope to the known backup directory path (e.g., C:\ProgramData\Veeam\BackupStaging).

• Scenario: Adobe Acrobat Pro Document Conversion Batch Process

  • Context: An administrative batch job uses AcroRdr64.exe or AdobePDFMaker.exe to convert a large volume of PDF documents into encrypted, password-protected formats for compliance archiving. The rule interprets the high-volume file modification and encryption header changes as ransom