Catches Stampado samples looking for \\r at the beginning of PE overlay section

Hunt Hypothesis

This hunt targets adversaries utilizing the Stampado malware family by identifying suspicious Portable Executable (PE) files that exhibit an anomalous carriage return character (\\r) at the start of their overlay sections. Proactively hunting for this specific artifact in Azure Sentinel is critical to detect early-stage infections and potential command-and-control infrastructure, even when initial alert severity is low.

YARA Rule

rule stampado_overlay
{
meta:
description = "Catches Stampado samples looking for \\r at the beginning of PE overlay section"
reference = ""
author = "Fernando Merces, FTR, Trend Micro"
date = "2016-07"
md5 = "a393b9536a1caa34914636d3da7378b5"
md5 = "dbf3707a9cd090853a11dda9cfa78ff0"
md5 = "dd5686ca7ec28815c3cf3ed3dbebdff2"
md5 = "6337f0938e4a9c0ef44ab99deb0ef466"

condition:
pe.characteristics == 0x122 and
pe.number_of_sections == 5 and
pe.imports("VERSION.dll", "VerQueryValueW") and uint8(pe.sections[4].raw_data_offset + pe.sections[4].raw_data_size) == 0x0d

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

References

• ""
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios where legitimate enterprise activities trigger the “Stampado PE Overlay \\r” detection rule, along with suggested filters:

• Microsoft Office Click-to-Run Updates

  • Scenario: The Microsoft Office Click-to-Run service frequently generates temporary installer packages or updates Word/Excel components. These installers often embed legacy headers in their PE overlay sections that utilize a carriage return (\r) character at the start of the data stream to denote specific metadata blocks, mimicking the Stampado artifact signature.
  • Suggested Filter: Exclude processes running under OfficeClickToRun.exe and paths containing \Microsoft Office\ClickToRun\. Additionally, whitelist file hashes associated with known Microsoft Office update versions (e.g., *Office*.msi, *Setup.exe).

• Antivirus Real-Time Scanning of Large Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or SentinelOne often perform deep inspection on large compressed archives (.zip, .7z) containing executable payloads. When these agents unpack or scan the internal structure of a PE file within an archive, they may create temporary overlay data that begins with \r to align with legacy compression standards, triggering the rule during routine scheduled scans.
  • Suggested Filter: Create an exclusion for processes known as security scanners (e.g., C:\Program Files\CrowdStrike\fs.exe, SentinelOne Agent) when they are operating on file extensions .zip, .7z, or .cab. Limit the rule to trigger only if the parent process is not a recognized security vendor.

• Scheduled PowerShell Script Execution for Patch Management

  • Scenario: IT administrators often run scheduled PowerShell scripts (e.g., via Task Scheduler) to deploy patches using tools like SCCM or WSUS.