Petite13

Hunt Hypothesis

This detection identifies potential malicious activity associated with the Petite13 signature, which often indicates specific file-based threats or behavioral anomalies within the environment. A proactive hunt is recommended to validate these occurrences against known benign patterns and uncover early-stage indicators of compromise that may not trigger high-severity alerts in Azure Sentinel.

YARA Rule

rule Petite13
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: Petite13

• Scenario: Legitimate execution of the Microsoft Office Click-to-Run update service (OfficeC2RClient.exe) performing background patching. This process often spawns child processes that match the behavioral signature of the Petite13 rule due to its interaction with the Windows Update infrastructure and registry modifications.

  • Suggested Filter: Exclude the specific executable path C:\Program Files\Microsoft Office Client\OfficeC2RClient.exe and its immediate child processes from triggering alerts when running under the SYSTEM or Network Service account context.

• Scenario: Scheduled nightly backup jobs executed by Veeam Backup & Replication (specifically the vbrsvc.exe service) which creates temporary files and modifies file system attributes in a manner that mimics the detection logic of Petite13.

  • Suggested Filter: Create an exclusion for processes running under the scheduled task “VeeamBackupJob” or filter by the command line argument containing --mode=backup to distinguish legitimate backup operations from suspicious file creation events.

• Scenario: Deployment of security policy updates via Microsoft Endpoint Configuration Manager (SCCM) where the ccmsetup.exe installer runs during maintenance windows, triggering file integrity checks that overlap with the rule’s detection criteria.

  • Suggested Filter: Implement a time-based exclusion window (e.g., 01:00 – 05:00 local time) for alerts generated by ccmsetup.exe and wuauserv.exe, or exclude specific file hashes associated with the latest SCCM client version.

• Scenario: Automated code signing verification performed by Antivirus engines (e.g., CrowdStrike Falcon or Symantec Endpoint Protection) scanning newly downloaded artifacts in a shared network drive, which generates process