NoodleCryptv200EngNoodleSpa

Hunt Hypothesis

This YARA rule targets the NoodleCrypt v200 engine, a lightweight crypter commonly used by threat actors to obfuscate malicious payloads and evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised hosts or staged malware artifacts early, reducing the risk of dynamic execution before traditional behavioral detections trigger.

YARA Rule

rule NoodleCryptv200EngNoodleSpa
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a local build script that compiles a C++ or Rust project using a custom linker or obfuscation tool (e.g., upx or a proprietary noodle-sp wrapper) for a microservice deployment. The resulting binary contains the specific byte patterns or string references targeted by the NoodleCryptv200EngNoodleSpa rule.

  • Filter/Exclusion: Exclude processes where the parent process is msbuild.exe, dotnet.exe, cargo.exe, or make.exe, and the file path resides within standard development directories like C:\dev\, D:\builds\, or C:\Users\<user>\.nuget\.

• Scenario: An automated scheduled task (e.g., Task Scheduler job “NightlyDataSync”) executes a custom Python or PowerShell script that invokes a native helper executable (noodle_helper.exe) to encrypt/decrypt log files before archiving them to the data lake. The helper binary is signed but matches the YARA signature due to its embedded encryption library.

  • Filter/Exclusion: Exclude events where the process name is noodle_helper.exe or noodle_helper64.exe and the parent process is python.exe, powershell.exe, or pwsh.exe, provided the file path is under C:\Scripts\ or C:\Automation\.

• Scenario: A third-party vendor tool (e.g., a specific version of NoodleSpa client or a legacy NoodleCrypt utility) is installed in a restricted application pool for a legacy line-of-business application. The tool is whitelisted in AppLocker but still triggers the YARA scan during its periodic self-check or update routine.

  • Filter/Exclusion: Exclude processes where the file path