Petite21

Hunt Hypothesis

This detection identifies potential fileless or memory-resident threats leveraging the Petite21 signature to uncover stealthy adversary activities that may evade traditional signature-based defenses. A proactive hunt is essential in Azure Sentinel to validate these low-severity alerts against broader telemetry, ensuring that subtle indicators of compromise are not overlooked before they escalate into significant incidents.

YARA Rule

rule Petite21
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Petite21 detection rule in an enterprise environment, including targeted filters and exclusions:

• Scenario: Microsoft Defender Antivirus Real-Time Protection Scanning

  • Context: The YARA rule may flag the MsMpEng.exe process when it performs real-time scanning of user documents or system updates, mistaking its memory footprint for a Petite21 signature. This often occurs during peak business hours when users are actively saving files.
  • Filter/Exclusion: Exclude processes where the executable path matches C:\Program Files\Windows Defender\MsMpEng.exe and the parent process is svchost.exe (specifically the “Antimalware Service” service).

• Scenario: Scheduled Office 365 ProPlus Click-to-Run Updates

  • Context: The rule triggers during the daily scheduled update cycle of Microsoft Office. The OfficeClickToRun.exe process loads specific DLLs that match the Petite21 signature, particularly when updating Outlook or Word components on endpoints with heavy user activity.
  • Filter/Exclusion: Apply a time-based exclusion for events occurring between 02:00 and 04:00 (local time) where the process name is OfficeClickToRun.exe and the command line contains /update.

• Scenario: Enterprise Backup Agent Scanning (Veeam or Commvault)

  • Context: During nightly backup windows, agents like Veeam Transport Service (vssvc.exe) or Commvault Command Center scan large file sets. The memory allocation patterns of these agents often mimic the Petite21 detection logic, causing high-volume alerts during the backup window.
  • Filter/Exclusion: Create a rule exclusion for any event where the process image contains Veeam or `Comm