This YARA rule targets specific memory patterns or code artifacts associated with the “piritv15” signature, potentially indicating the presence of a low-severity malware variant or a benign tool with suspicious characteristics. Proactively hunting for this signature allows the SOC team to identify dormant or stealthy threats in Azure Sentinel that may evade standard behavioral detections, ensuring early visibility into potentially compromised workloads.
rule piritv15
{
meta:
author="malware-lu"
strings:
$a0 = { 5B 24 55 50 44 FB 32 2E 31 5D }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer is performing a local build or compilation of a C/C++ project using gcc or cl.exe, where the compiler generates intermediate object files (.o or .obj) that match the binary signature pattern defined in piritv15.
*/build/*, */obj/*, */bin/*) or files with extensions .o, .obj, .a, .lib generated by known compiler processes (gcc, cl.exe, csc.exe).Scenario: An IT administrator is running a disk cleanup or archive utility (such as 7-Zip or WinRAR) to compress large log files or database dumps, creating a temporary compressed archive (.zip, .7z, .tar) that contains a binary segment matching the YARA rule’s byte pattern.
.zip, .7z, .rar, .tar, .gz) created by known archiving tools (7z.exe, WinRAR.exe, tar.exe) and located in temporary or backup directories (e.g., C:\Temp\, D:\Backups\).Scenario: A security team is executing a vulnerability scanner or integrity checker (e.g., clamscan, trid, or a custom hash verification script) that reads binary executables or libraries into memory or creates temporary copies for analysis, triggering the YARA match on the temporary file.
clamscan.exe, trid.exe, file.exe) or files located in the system’s temporary directory (%TEMP%, C:\Windows\Temp) with a recent creation timestamp (< 1