This hypothesis targets the presence of Themida 1201 compressed binaries, a specific version of a commercial software protection tool frequently leveraged by threat actors to obfuscate malicious payloads and hinder static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially hidden or packed executables that may be evading standard detection mechanisms, thereby reducing the risk of undetected malware execution within the environment.
rule Themida_1201_compressed_Oreans_Technologies_h: PEiD
{
strings:
$a = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Themida GUI application (e.g., Themida.exe) to compress or protect a newly built .NET or C++ application binary before deployment.
devenv.exe, code.exe) or a build tool (e.g., msbuild.exe, dotnet.exe) and the image path contains \Themida\ or \Oreans Technologies\.themida.exe or themida_cli.exe) as part of a post-build packaging task.
agent.exe, jenkins.exe, docker.exe running a build container) and the command line arguments contain keywords like --compress, --protect, or --input.TaskScheduler.exe or svchost.exe (with specific service GUIDs) and the image path is located in a standard maintenance or tools directory (e.g., C:\Scripts\, C:\AdminTools\).