PassLock2000v10EngMoonlightSoftware

Hunt Hypothesis

This YARA rule targets the PassLock 2000 v10 English Moonlight software, a credential management tool often deployed in enterprise environments to store and manage sensitive passwords. Proactively hunting for this signature helps the SOC identify potential unauthorized installations or specific versions of the tool that may be leveraged by adversaries to access stored credentials or indicate a specific software footprint within the Azure Sentinel environment.

YARA Rule

rule PassLock2000v10EngMoonlightSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually installs the PassLock Password Manager client on a newly provisioned workstation to enforce password policy compliance. The installation process writes the PassLock.exe binary and associated DLLs to the C:\Program Files\PassLock\ directory, triggering the YARA signature match on the executable or its memory space.

  • Filter/Exclusion: Exclude files located in the standard installation path C:\Program Files\PassLock\ or C:\Program Files (x86)\PassLock\ where the parent process is setup.exe or msiexec.exe and the user is a member of the Domain Admins or IT Admins security group.

• Scenario: A scheduled maintenance job runs a PowerShell script to update the PassLock client to the latest version across the fleet. The update process temporarily extracts the new PassLock2000v10EngMoonlightSoftware binaries to a temporary directory (%TEMP% or C:\Windows\Temp) before moving them to the final location, causing the YARA rule to detect the file in the transient location.

  • Filter/Exclusion: Exclude detections where the file path contains \Temp\ or %TEMP% and the parent process is powershell.exe or pwsh.exe with a command line argument containing Update-Client or Install-Update.

• Scenario: A security team performs a controlled test of the PassLock client on a non-production test server to verify integration with the Active Directory domain controller. The test involves running the PassLock service (PassLockService.exe) and its associated agent, which loads the specific versioned binaries into memory, triggering the YARA rule during the test window.

  • Filter/Exclusion: Exclude detections on hosts tagged with the Test-Environment or Lab