PCGuardv500d

Hunt Hypothesis

This YARA rule targets the PCGuardv500d component, a known element of the PCGuard malware family often used for adware or potentially unwanted program (PUP) installation. Proactively hunting for this signature in Azure Sentinel helps identify compromised endpoints or user sessions where this low-severity threat has been deployed, allowing the SOC to isolate affected assets before they escalate into more significant security incidents.

YARA Rule

rule PCGuardv500d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or sysadmin uses the PCGuard utility (a legacy Windows system protection/monitoring tool) to perform a manual integrity scan or backup of system files during a maintenance window.
  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe, powershell.exe, or conhost.exe and the command line contains arguments like /scan, /backup, or /verify. Alternatively, whitelist the specific user account (e.g., DOMAIN\svc-pcguard) or the service account running the job.
• Scenario: A scheduled task runs PCGuard as part of a nightly system health check or disk integrity verification routine, often triggered by Task Scheduler (svchost.exe or taskschd.msc).
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe and the parent command line contains TaskScheduler or taskschd. Additionally, filter out executions occurring during defined maintenance windows (e.g., 02:00–04:00 AM) if the rule is time-sensitive.
• Scenario: An enterprise endpoint management agent (such as SCCM, Intune, or a custom GPO script) pushes the PCGuard binary to endpoints for configuration or updates, causing the file to be written to disk and potentially executed briefly for registration.
  • Filter/Exclusion: Exclude file creation or execution events where the parent process is a known management agent (e.g., ccmexec.exe, intunemanagertool.exe, or gpmc.exe). Whitelist the specific path where the agent stores tools (e.g., C:\Windows\CCM\ or C:\Program Files\Intune\).
• Scenario: A security analyst or incident responder manually runs `PC