PocketPCARM

Hunt Hypothesis

This detection identifies potential legacy or embedded device activity by matching network traffic against the specific PocketPCARM signature, which may indicate the presence of outdated systems vulnerable to modern threats. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to map and secure potentially unmonitored endpoints that could serve as entry points for lateral movement or data exfiltration attacks within the broader enterprise environment.

YARA Rule

rule PocketPCARM
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 [3] EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 [2] 9F E5 [5] 00 [8] 9F E5 00 [4] 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PocketPCARM detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Legacy Mobile Device Management (MDM) Updates

  • Context: Enterprise Mobility Management tools like Microsoft Intune or VMware Workspace ONE frequently push configuration profiles or application updates to legacy Pocket PC devices. These processes often involve the execution of ARM-based binaries or scripts that mimic the behavior of the targeted malware, particularly when deploying “ActiveSync” synchronization agents.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for the specific process paths used by the MDM client (e.g., C:\Program Files\Microsoft Intune Management Extension\IntuneMgmtAgent.exe) and exclude any network traffic originating from known MDM server IP ranges during standard maintenance windows.

• Scenario: Scheduled Antivirus Heuristic Scans on ARM Emulators

  • Context: Security operations teams often run scheduled scans using tools like CrowdStrike Falcon or Symantec Endpoint Protection against virtualized ARM environments (e.g., Windows on ARM VMs). The heuristic engine may flag the scanning process itself as a PocketPCARM variant because it loads specific DLLs associated with mobile emulation layers.
  • Suggested Filter/Exclusion: Implement a time-based exclusion rule that suppresses alerts for this detection between 02:00 and 04:00 UTC, coinciding with the nightly backup and scan job schedule defined in Task Scheduler (e.g., Microsoft.Windows.SystemUpdate tasks).

• Scenario: Deployment of Line-of-Business (LOB) Mobile Applications via SCCM

  • Context: The IT department uses Microsoft System Center Configuration Manager (SCCM) to deploy custom line-of-business applications to field tablets. During the installation phase, the