PMODEWv112116121133DOSextender

Hunt Hypothesis

This detection identifies potential DOS extender activity associated with the PMODEWv112116121133 signature, which may indicate legacy system exploitation or specific malware behavior targeting Windows environments. SOC teams should proactively hunt for this pattern in Azure Sentinel to uncover low-severity anomalies that could serve as early indicators of broader compromise chains or unauthorized legacy component usage before they escalate into critical incidents.

YARA Rule

rule PMODEWv112116121133DOSextender
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 16 07 BF [2] 8B F7 57 B9 [2] F3 A5 06 1E 07 1F 5F BE [2] 06 0E A4 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PMODEWv112116121133DOSextender detection rule, along with recommended filters and exclusions:

• Scenario: Microsoft Defender Antivirus Real-Time Scanning of Legacy Executables

  • Context: The Microsoft Defender service (MsMpEng.exe) frequently scans legacy .exe or .com files stored in network shares that utilize DOS-based extender headers. During high-volume scanning, the YARA rule triggers on these legitimate binaries as they are accessed by the engine’s worker threads.
  • Filter/Exclusion: Create a process exclusion for MsMpEng.exe and its child processes within the Defender console configuration to ignore files matching this signature during real-time scan operations.

• Scenario: Scheduled Backup Jobs Executing via Robocopy or Veeam

  • Context: Enterprise backup solutions like Veeam Backup & Replication or scheduled Robocopy tasks often copy large volumes of legacy application binaries (e.g., old ERP modules) to backup repositories. The file system activity generated during the copying phase triggers the rule on the destination files.
  • Filter/Exclusion: Exclude the specific backup service accounts (e.g., VeeamBRService, RobocopyAdmin) and restrict the detection scope to exclude paths within the designated backup repository folders (e.g., \Backup\LegacyApps\).

• Scenario: Deployment of Legacy Applications via SCCM/Intune

  • Context: When Microsoft Endpoint Configuration Manager (SCCM) or Intune deploys legacy applications containing DOS extender components, the installation engine (ccmsetup.exe or TfService.exe) writes these specific file structures to the client machine. The rule fires during the initial write phase of the deployment package.