Petite12

Hunt Hypothesis

This detection identifies the presence of the Petite12 malware signature within endpoint telemetry, signaling potential early-stage fileless or memory-resident threats that may evade traditional antivirus solutions. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to validate its scope across the environment and assess lateral movement risks before the adversary establishes a persistent foothold.

YARA Rule

rule Petite12
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: Petite12

• Scenario: Legitimate deployment of Microsoft System Center Configuration Manager (SCCM) or Intune pushing application updates to endpoints. The YARA rule may flag the ccmsetup.exe process or associated installers as suspicious due to their behavior of writing to temporary directories and spawning child processes, which mimics the Petite12 detection logic.

  • Suggested Filter: Exclude processes originating from the C:\Windows\CCM\ directory path and specifically filter out executable names matching ccmsetup.exe, wuauserv.exe, and msiexec.exe when launched by the SYSTEM or NT SERVICE\WUAUSERV accounts.

• Scenario: Scheduled antivirus definition updates performed by enterprise security suites such as CrowdStrike Falcon, Symantec Endpoint Protection, or Microsoft Defender for Endpoint. These engines frequently download and unpack signature databases in the background, triggering file creation events that match the Petite12 pattern.

  • Suggested Filter: Create an exclusion rule based on known good process hashes (SHA-256) for the primary security agent executables (e.g., falcon.sys, rtvscan.exe) and exclude any activity occurring within the standard update window (e.g., 02:00–04:00 local time) initiated by these specific processes.

• Scenario: Automated backup jobs running via Veeam Backup & Replication or Commvault, which involve high-volume file I/O and temporary staging of data in network shares. The rule may misinterpret the rapid creation of temporary .tmp files and subsequent compression activities as anomalous behavior.

  • Suggested Filter: Implement a path-based exclusion for backup staging directories (e.g., \\BackupServer\Staging\, C:\ProgramData\Veeam\) and exclude processes with