This rule detects the presence of SmokesCrypt, a lightweight Windows crypter often used by threat actors to obfuscate malicious payloads and evade static analysis during initial access or execution phases. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised hosts where adversaries are deploying obfuscated binaries, enabling early intervention before the payload is decrypted and executed in memory.
rule SmokesCrypt_v12: PEiD
{
strings:
$a = { 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legitimate Application Deployment via MSI/EXE Installers: Many enterprise software packages (e.g., Adobe Creative Cloud, Microsoft Office, or custom internal tools) use encrypted or packed installers that may match the SmokesCrypt signature if the detection logic targets common packing algorithms or specific byte patterns found in modern installers.
msiexec.exe or setup.exe and the file path contains standard installation directories like C:\Program Files\ or C:\Windows\Installer\. Additionally, whitelist known executable names such as setup.exe, install.exe, or vendor-specific installers (e.g., adobe_setup.exe).Scheduled Backup or Archiving Jobs: Enterprise backup solutions (e.g., Veeam, Commvault, or Windows Server Backup) often create compressed or encrypted archive files (.zip, .7z, .vbk) that may be scanned by YARA rules targeting packed or encrypted content. If the rule inspects file headers or specific entropy patterns, these legitimate archives can trigger false positives.
.vbk, .zip, .7z, .tar, .gz) when the parent process is a known backup agent (e.g., veeam.exe, commvault_agent.exe, wbadmin.exe). Also, exclude paths under standard backup storage locations like \\server\backups\ or C:\Backup\.Development and Testing Environments: Developers frequently use packed or obfuscated binaries for testing, especially when working with .NET assemblies compiled with specific packers or when using tools like ILSpy or dotnet build outputs that may exhibit characteristics matching the SmokesCrypt signature. This is common in CI/CD pipelines or developer workstations.