This hypothesis targets the presence of the Pelles C compiler, a lightweight C development environment often utilized by threat actors to compile custom malware payloads or exploit code directly on compromised hosts. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify potential build environments or staging areas for malicious code generation, which may indicate an adversary preparing for execution or persistence despite the low severity rating.
rule PellesC28x45xPelleOrinius
{
meta:
author="malware-lu"
strings:
$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy C Compiler Maintenance by DevOps Team: The pellec.exe compiler binary is a lightweight, standalone C compiler often used by DevOps engineers or embedded systems developers to quickly compile small utility scripts or test harnesses without installing a full IDE like Visual Studio. This can trigger the rule if the binary is executed from a user’s home directory or a temporary build folder rather than a standard system path.
pellec.exe if the parent process is a known development tool (e.g., cmd.exe, powershell.exe, bash.exe) and the file path contains keywords like \build\, \temp\, or \dev\.Automated Firmware Update Job: A scheduled task (e.g., Windows Task Scheduler job named Firmware_Patch_Update) runs a custom script that uses pellec.exe to recompile a small C-based configuration parser before applying firmware updates to network appliances. This is a legitimate, recurring administrative task that may be flagged if the rule does not account for scheduled task contexts.
svchost.exe (specifically the Schedule service) or if the command line contains arguments related to firmware or patching (e.g., --update, --apply).CI/CD Pipeline Build Agent: In a continuous integration environment, a build agent (e.g., jenkins-agent.exe or azure-pipelines-agent.exe) executes pellec.exe as part of a unit test step to compile C test cases. The binary is often downloaded or extracted to a workspace directory during the build process, leading to a high-entropy or unusual path trigger.