Shrinkv20

Hunt Hypothesis

This hypothesis targets the execution of the Shrinkv20 malware variant, a known threat actor tool often used for initial access or lateral movement within enterprise networks. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary establishes persistence or exfiltrates data, reducing the mean time to detection for low-severity but high-impact threats.

YARA Rule

rule Shrinkv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [2] 50 9C FC BE [2] 8B FE 8C C8 05 [2] 8E C0 06 57 B9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps team deploys a custom PowerShell script to a fleet of Windows Server 2019 machines to clean up temporary build artifacts. The script uses the Compress-Archive cmdlet (which internally invokes tar.exe or 7z.exe depending on the environment) to create .zip files in the C:\Temp directory. If the YARA rule Shrinkv20 targets specific compression library signatures or known shrinker binaries (like 7z.exe, rar.exe, or zip.exe) in non-standard paths, this legitimate cleanup job will trigger the alert.

  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the working directory is under C:\Temp, C:\Builds, or C:\Artifacts. Alternatively, whitelist specific known-good hashes of the compression tools used by the DevOps pipeline.

• Scenario: An IT administrator runs a scheduled task named “Quarterly Log Rotation” on domain controllers. This task uses logrotate.exe (a custom internal tool) or 7z.exe to compress and archive IIS logs and application logs from C:\Logs to D:\Archive. The YARA rule may flag the 7z.exe binary if it is located in a non-standard directory like C:\Scripts\Tools rather than C:\Windows\System32, or if the rule detects the specific version string of the 7-Zip library.

  • Filter/Exclusion: Whitelist the specific file path C:\Scripts\Tools\7z.exe by its SHA256 hash. Additionally, exclude alerts where the parent process is svchost.exe (indicating a scheduled task) and the target path ends with .log or .zip in the `D:\