PocketPCMIB

Hunt Hypothesis

This detection identifies the presence of the PocketPCMIB tool, which adversaries often leverage to establish persistent command and control channels or facilitate lateral movement within compromised environments. Proactively hunting for this indicator in Azure Sentinel is essential to uncover stealthy post-exploitation activities that may evade standard signature-based alerts due to their low-severity classification.

YARA Rule

rule PocketPCMIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF [3] 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F [3] 0C 24 00 A7 8F [3] 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PocketPCMIB detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Scans

  • Context: Enterprise anti-virus solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often perform scheduled “On-Access” or “On-Demand” scans that utilize the PocketPCMIB component to query system configuration and policy settings. This activity mimics the behavior of a potential reconnaissance tool.
  • Filter/Exclusion: Create an exclusion based on the process image path and parent process name. Exclude any instance where Image contains \Program Files\CrowdStrike\ (or respective vendor paths) AND ParentProcessName is falcon.sys, ssd.exe, or MsMpEng.exe.

• Scenario: Group Policy Object (GPO) Application

  • Context: During the standard 90-minute GPO refresh cycle, the Group Policy Client Service (gpsvc.dll) executes to apply new policies. This process frequently invokes PocketPCMIB to validate compliance settings and retrieve configuration data from the domain controller, triggering the rule during peak business hours (e.g., 8:00 AM – 9:30 AM).
  • Filter/Exclusion: Implement a time-based filter combined with a parent process exclusion. Exclude alerts where ParentProcessName is svchost.exe and the service name matches gpsvc, specifically during the window of Monday–Friday, 08:00 to 10:00.

• Scenario: IT Asset Management Inventory Runs

  • Context: Automated inventory tools such as ServiceNow Discovery, Lansweeper, or PDQ Deploy run nightly or hourly jobs to