SLVc0deProtectorv11SLV

Hunt Hypothesis

This hypothesis targets the presence of the SLVc0deProtector v11 code protector, a tool frequently used by adversaries to obfuscate malicious payloads and evade static analysis during initial access or post-compromise stages. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious artifacts that may have been deployed to hide the true intent of malware before it executes or establishes persistence.

YARA Rule

rule SLVc0deProtectorv11SLV
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C }
	$a1 = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }

condition:
		$a0 at pe.entry_point or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the SLVc0deProtectorv11SLV binary during a scheduled patching cycle by WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) agents. The rule may match the specific versioning string or memory layout of the updater service when it loads into memory to apply security updates.

  • Filter/Exclusion: Exclude processes where the parent process is WuaExe.exe (Windows Update) or CcmExec.exe (SCCM Client), and the file path resides in C:\Windows\SoftwareDistribution\ or C:\Program Files\Microsoft Configuration Manager\.

• Scenario: Legitimate execution by Microsoft Defender Antivirus or CrowdStrike Falcon during a real-time scan or on-demand cleanup task. The YARA rule might trigger on the in-memory representation of the scanner engine or a temporary quarantine extraction folder that contains the specific version tag v11SLV.

  • Filter/Exclusion: Exclude processes with parent names MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike), and restrict the file path to standard AV working directories like C:\ProgramData\Microsoft\Windows Defender\ or C:\ProgramData\CrowdStrike\.

• Scenario: Deployment of Intune or Group Policy software distribution tasks that install or update a third-party application bundle (e.g., a Java runtime or .NET Framework update) that includes a component named or versioned with the SLV prefix. The rule may match the installer service or the resulting DLL loaded into a user session.

  • Filter/Exclusion: Exclude processes where the parent is AgentUtil.exe (Intune) or svchost.exe (with the gpupdate or `