tElockv042

Hunt Hypothesis

This detection identifies potential malicious activity through a specific YARA signature (tElockv042) that targets known file patterns or behavioral indicators within the environment. Proactively hunting for this signal in Azure Sentinel allows the SOC team to uncover low-severity threats that may serve as early indicators of broader compromise, ensuring timely investigation before adversaries escalate their operations.

YARA Rule

rule tElockv042
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the tElockv042 detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Real-Time Scanning

  • Context: The YARA rule detects file locking or process behavior associated with MsMpEng.exe (Microsoft Defender) when it scans a large batch of user documents in the C:\Users\Public\Documents directory. This often triggers during peak business hours, mimicking malicious file enumeration.
  • Filter/Exclusion: Exclude the specific process path C:\Program Files\Windows Defender\MsMpEng.exe from the detection logic when the accessed file extension matches common document types (.docx, .xlsx, .pdf) within user profile directories.

• Scenario: Scheduled System Backup via Veeam Agent

  • Context: A nightly scheduled backup job running VeeamAgent.exe performs a full image capture of the system drive. The rule interprets the high volume of file handles and locking mechanisms during the snapshot creation as suspicious activity, particularly when the agent accesses the System Volume Information folder.
  • Filter/Exclusion: Create an exclusion for the process name VeeamAgent.exe (and its child processes) specifically when running under the “SYSTEM” account context between 01:00 and 05:00 local time, or exclude paths containing \System Volume Information\.

• Scenario: Office 365 Click-to-Run Update Service

  • Context: The OfficeClickToRun.exe service initiates a background update for the Microsoft 365 suite. This process frequently locks configuration files in %ProgramFiles%\Microsoft Office\root\Office16, triggering the rule’s logic regarding unexpected file modification and locking patterns.