This rule detects the presence of the PocketPCSHA YARA signature, which typically identifies specific legacy or embedded code artifacts that may indicate unauthorized software execution or persistence mechanisms. Proactively hunting for this pattern in Azure Sentinel allows the SOC team to identify low-severity anomalies or dormant components that could serve as footholds for further compromise, ensuring early detection of subtle adversary activity.
rule PocketPCSHA
{
meta:
author="malware-lu"
strings:
$a0 = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 [3] 00 [3] 00 [3] 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are specific false positive scenarios for the PocketPCSHA YARA rule, which typically detects the presence of the pocketpcsha library or related SHA-1 implementation artifacts often found in legacy Windows CE/PocketPC environments or specific embedded/legacy applications.
C:\Program Files (x86)\Microsoft Intune\ or C:\Program Files\Microsoft System Center Configuration Manager\ if the executable name matches known MDM agent binaries (e.g., IntuneAgent.exe, CCMSetup.exe).dotnet.exe or w3wp.exe and the loaded module path contains \LegacyCrypto\ or \OldSHA\, or specifically exclude known legacy application executables like LegacyERP.exe or OldInventoryTool.exe.pocketpcsha library in memory or on disk if the VM was not fully updated, triggering the rule during live migration or backup operations.
*