PellesC2x4xDLLPelleOrinius

Hunt Hypothesis

This detection identifies adversary activity involving the execution of specific DLLs associated with the Pelle or Orinius malware families, which often serve as indicators for initial foothold establishment or lateral movement. Proactively hunting for these signatures in Azure Sentinel is essential to uncover low-severity but potentially stealthy threats that may evade standard signature-based defenses and require deeper behavioral analysis before escalating into critical incidents.

YARA Rule

rule PellesC2x4xDLLPelleOrinius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PellesC2x4xDLLPelleOrinius detection rule, along with suggested filters and exclusions:

• Scenario: Deployment of Legacy Engineering CAD Plugins

  • Context: The engineering department uses a legacy CAD suite (e.g., AutoCAD or SolidWorks) that relies on custom C++ DLLs compiled using the PellesC compiler for specific rendering plugins. These DLLs are frequently updated via Group Policy or SCCM during business hours.
  • Filter/Exclusion: Create an exclusion based on the file path and publisher signature. Exclude files located in C:\Program Files\AutoCAD 202x\Plugins\ where the digital certificate is issued by “Engineering Solutions Corp” (or the specific internal CA).

• Scenario: Scheduled Maintenance of Internal Reporting Tools

  • Context: A nightly scheduled task runs a custom reporting engine built on the PellesC framework to aggregate financial data. This job executes at 2:00 AM and generates temporary DLLs in the Temp directory before archiving them, triggering the YARA rule during the build phase.
  • Filter/Exclusion: Implement a time-based exclusion for the specific process name (e.g., ReportEngine.exe) running between 01:00 and 04:00 on weekdays. Alternatively, exclude the directory C:\ProgramData\InternalReports\BuildOutput\ from scanning.

• Scenario: Installation of Third-Party Virtualization Agents

  • Context: The IT team deploys a new version of a virtual desktop infrastructure (VDI) agent (e.g., VMware Horizon or Citrix Workspace). The installer extracts several helper DLLs compiled with PellesC to the System32 folder during the installation phase, which is detected as a potential C2