RSCsProcessPatcherv151

Hunt Hypothesis

This rule detects the presence of the RSCsProcessPatcher tool, a utility frequently used by adversaries to modify Windows process structures in memory to hide malicious processes or bypass security controls. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potential in-memory process manipulation techniques that may evade standard endpoint detection, ensuring early discovery of stealthy post-exploitation activities.

YARA Rule

rule RSCsProcessPatcherv151
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps team uses a custom PowerShell script to patch a legacy .NET application binary in memory or on disk before deployment, triggering the YARA signature for process patching.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains specific keywords like patch, update, or deploy, or exclude based on the specific user account used for deployment (e.g., svc-deploy).
• Scenario: An enterprise endpoint protection agent (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) performs real-time process patching or instrumentation to monitor application behavior, which matches the YARA rule’s signature for patched process structures.
  • Filter/Exclusion: Exclude known EDR agent process names (e.g., FalconSensor.exe, Cb.exe, SentinelOne.exe) or exclude events where the parent process is a known EDR service.
• Scenario: A scheduled maintenance job runs a proprietary tool (e.g., app-patcher.exe or license-updater.exe) that applies hotfixes to running services or updates configuration binaries, triggering the detection.
  • Filter/Exclusion: Exclude specific executable names known to perform legitimate patching (e.g., app-patcher.exe, license-updater.exe) or exclude events occurring during a defined maintenance window (e.g., 02:00-04:00 UTC) for specific service accounts.
• Scenario: A developer uses a debugger (e.g., WinDbg, x64dbg, or Visual Studio) to attach to a process and modify its memory or code during a testing phase, which the YARA rule interprets as a suspicious patch.
  • Filter/Exclusion: Exclude processes where the parent process is a known