This YARA rule targets specific characteristics of private or custom-built executable files, indicating potential use of non-standard tooling or obfuscated payloads by an adversary. Proactively hunting for these artifacts in Azure Sentinel helps identify stealthy malware or custom utilities that may evade generic signature-based detections.
rule PrivateEXEv20a
{
meta:
author="malware-lu"
strings:
$a0 = { 53 E8 00 00 00 00 5B 8B C3 2D }
$a1 = { 06 60 C8 [3] 0E 68 [2] 9A [4] 3D [2] 0F [3] 50 50 0E 68 [2] 9A [4] 0E }
$a2 = { 53 E8 [4] 5B 8B C3 2D [4] 50 81 [5] 8B }
condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 3 string patterns in its detection logic.
strings.exe utility by a security engineer or developer analyzing a binary for hardcoded credentials or configuration strings.
C:\Sysinternals\strings.exe or C:\Tools\Sysinternals\strings.exe if the parent process is a known administrative tool (e.g., powershell.exe, cmd.exe, or conhost.exe) and the user belongs to the SecurityTeam or DevOps group.7z.exe (7-Zip) to compress log files or backup configurations, where the archive header or embedded metadata matches the YARA pattern due to specific compression algorithms or file signatures.
7z.exe or 7za.exe when the command line contains arguments like a (add), t (test), or x (extract) and the working directory is within designated backup or log paths (e.g., D:\Backups\, C:\Logs\).dotnet.exe or csc.exe (C# Compiler) during a CI/CD pipeline build or local development build, where the generated executable or intermediate assembly contains byte patterns that trigger the rule.
dotnet.exe, csc.exe, or msbuild.exe when the parent process is vstest.console.exe, dotnet.exe (in a build context), or powershell.exe running a build script, and the path contains bin\, obj\, or build\.Wireshark or **`tshark