PEQuakev006byfORGAT

Hunt Hypothesis

This YARA rule targets specific characteristics of the PEQuake malware, a known threat often used for initial access or lateral movement, allowing analysts to identify compromised hosts based on static binary signatures. Proactively hunting for this indicator in Azure Sentinel helps the SOC team detect low-severity infections early, preventing potential escalation to more impactful post-exploitation activities within the environment.

YARA Rule

rule PEQuakev006byfORGAT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or operations engineer manually runs the PEQuake utility (or a script wrapping it) to analyze a specific, suspicious .exe file downloaded from a vendor or internal build server. The YARA rule matches the binary’s header or specific string patterns associated with the PEQuake tool itself or its output artifacts.

  • Filter/Exclusion: Exclude files located in specific developer workspaces or temporary analysis directories (e.g., C:\Users\dev\analysis\, C:\Temp\pequake_out\). Alternatively, exclude processes where the parent process is a known IDE or terminal emulator (e.g., code.exe, powershell.exe) and the file path contains keywords like analysis, temp, or quarantine.

• Scenario: An automated vulnerability scanner (such as Nessus, Qualys, or Rapid7 InsightVM) deploys a lightweight agent or probe that uses PEQuake-like logic or includes the tool in its toolkit to inspect binaries on remote hosts. The rule triggers on the scanner’s worker process or the temporary copy of the tool placed in the system’s temp directory.

  • Filter/Exclusion: Exclude processes whose parent process is a known vulnerability scanner agent (e.g., nessusd.exe, qualys_agent.exe, insightvm_agent.exe). Additionally, exclude file paths under the scanner’s default installation or temp directories (e.g., C:\Program Files\Nessus\, C:\ProgramData\Qualys\).

• Scenario: A security team performs a manual red team or blue team exercise where they deploy a custom detection validation script that bundles the PEQuake tool to test endpoint detection coverage. The tool is executed from a shared network drive or a dedicated test folder.

  • Filter/Exclusion: Exclude files and processes originating from designated test or lab network shares (