Pohernah100byKas

Hunt Hypothesis

This detection identifies potential malware or suspicious artifacts matching the “Pohernah100byKas” YARA signature within Azure Sentinel’s workload data. Proactive hunting for this indicator is essential to uncover early-stage threats that may exhibit low severity initially but could evolve into significant compromises requiring immediate investigation.

YARA Rule

rule Pohernah100byKas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Pohernah100byKas detection rule, along with recommended filters and exclusions:

• Scenario: Legitimate execution of the Microsoft Defender Antivirus (MSEPM) scheduled scan process. The YARA rule may flag the MsMpEng.exe process when it spawns child processes to analyze specific file signatures in the background, matching the “Pohernah” pattern within the memory dump or binary structure.

  • Filter/Exclusion: Add a process name exclusion for MsMpEng.exe and restrict the rule trigger to exclude paths containing \Program Files\Windows Defender\.

• Scenario: Automated deployment of enterprise software updates via Microsoft Endpoint Configuration Manager (SCCM) or Intune. During the installation phase, the deployment agent (ccmsetup.exe) extracts compressed payloads that contain binary structures identical to those detected by the rule.

  • Filter/Exclusion: Create an exclusion based on the parent process name ccmexec.exe and exclude file paths under \Program Files\Microsoft Configuration Manager\.

• Scenario: Execution of a scheduled Kaspersky Security Center agent update or policy synchronization task. The rule may trigger when the Kaspersky agent (kavscan.exe or kslbase.exe) performs real-time scanning on network shares, generating memory signatures that overlap with the detection logic.

  • Filter/Exclusion: Exclude processes named kavscan.exe, kslbase.exe, and kavservice.exe originating from the directory \Program Files\Kaspersky Lab\.

• Scenario: Routine backup operations performed by Veeam Backup & Replication agents. When Veeam agents (vrb.exe) compress and encrypt large data sets, the resulting binary structures in memory often match the specific hash patterns defined