tElock099cPrivateECLIPSEtE

Hunt Hypothesis

This YARA rule targets the specific “ECLIPSE” malware variant, indicating the presence of a low-severity threat actor likely engaged in initial access or reconnaissance activities. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised endpoints or files before the adversary can establish persistence or escalate privileges.

YARA Rule

rule tElock099cPrivateECLIPSEtE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 3F DF FF FF 00 00 00 [4] 04 [2] 00 00 00 00 00 00 00 00 00 24 [2] 00 14 [2] 00 0C [2] 00 00 00 00 00 00 00 00 00 31 [2] 00 1C [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C [2] 00 00 00 00 00 4F [2] 00 00 00 00 00 3C [2] 00 00 00 00 00 4F [2] 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom internal build script or a specific version of a CI/CD agent (e.g., a patched Jenkins plugin or a private GitLab Runner) that embeds the string ECLIPSE as a namespace identifier, version tag, or internal project codename within its binary or configuration files.
  • Filter/Exclusion: Exclude processes running from the specific CI/CD agent directories (e.g., C:\ProgramData\Jenkins\, C:\GitLabRunner\) or filter by the specific user account used for service builds (e.g., svc-ci-builder).
• Scenario: An IT administrator installs a legacy or custom internal application named “Eclipse” (unrelated to the IDE) for a specific business unit, which stores its configuration or log files in a path containing the string ECLIPSE (e.g., C:\Program Files\InternalEclipse\config\).
  • Filter/Exclusion: Exclude file paths matching *\InternalEclipse\* or *\Eclipse\* if the application is whitelisted in the endpoint inventory, or filter by the specific executable name of the internal app (e.g., InternalEclipse.exe).
• Scenario: A scheduled maintenance job runs a custom PowerShell or Batch script that generates a report or log file with a filename containing ECLIPSE (e.g., ECLIPSE_Maintenance_Log_20231027.txt) to denote a specific internal project or phase of the maintenance cycle.
  • Filter/Exclusion: Exclude files created by the specific scheduled task account (e.g., svc-maintenance) or filter by the parent process of the file creation (e.g., powershell.exe or cmd.exe invoked by Task Scheduler).