PureBasic4xNeilHodgson

Hunt Hypothesis

This detection rule identifies the presence of the “PureBasic4xNeilHodgson” signature within file artifacts to uncover potential custom or legacy applications that may harbor unknown vulnerabilities. Proactively hunting for this specific indicator in Azure Sentinel allows the SOC team to assess its legitimacy and mitigate risks from niche software before it is leveraged by adversaries for lateral movement or data exfiltration.

YARA Rule

rule PureBasic4xNeilHodgson
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [2] 00 00 68 00 00 00 00 68 [3] 00 E8 [3] 00 83 C4 0C 68 00 00 00 00 E8 [3] 00 A3 [3] 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 [3] 00 A3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the PureBasic4xNeilHodgson detection rule, tailored for a legitimate enterprise environment:

• Scenario: Scheduled Compilation of Legacy Internal Tools

  • Context: The IT Operations team runs nightly builds using the PureBasic compiler to update internal inventory management utilities. The YARA signature triggers because these build scripts generate temporary .pb source files and compiled binaries that match the rule’s specific code patterns.
  • Filter/Exclusion: Exclude file paths containing C:\BuildServers\LegacyTools\PureBasic\Output\* or process names matching purebasic.exe when running under the service account svc-build-agent.

• Scenario: Deployment of Third-Party Analytics Dashboard

  • Context: The Data Science department deploys a custom analytics dashboard written in PureBasic. During the installation phase, the installer extracts and executes several helper modules that contain the exact byte sequences flagged by the rule, mimicking potential malicious behavior.
  • Filter/Exclusion: Create an exclusion for the specific file hash of the installer executable (AnalyticsDashboard_Installer_v2.exe) or whitelist the directory C:\Program Files\DataSci\Dashboards\PureBasicComponents.

• Scenario: Automated Code Review Scanning

  • Context: The DevSecOps pipeline utilizes a static analysis tool (e.g., SonarQube) that scans source code repositories. When scanning repositories containing PureBasic projects, the scanner reads and parses source files in memory, causing the YARA rule to fire on the temporary working directory of the scanner process.
  • Filter/Exclusion: Exclude processes named sonar-scanner.exe or gitlab-runner.exe when they are accessing directories under C:\SourceControl\Repos\PureBasicProjects.

• **Scenario: Administrative Script Execution