This detection identifies the presence of the Oreans Technologies license module (ThemidaWinLicense) on endpoints, which may indicate legitimate software usage or a potential supply chain compromise involving embedded licensing components. The SOC team should proactively hunt for this signature in Azure Sentinel to validate its expected deployment across the environment and rule out any anomalous instances that could serve as a foothold for adversaries leveraging trusted third-party binaries.
rule ThemidaWinLicenseV1802OreansTechnologies
{
meta:
author="malware-lu"
strings:
$a0 = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D [4] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the ThemidaWinLicenseV1802OreansTechnologies detection rule, including suggested filters and exclusions:
Scenario: Scheduled License Renewal Task on SQL Servers
Oreans Technologies licensing engine often runs as a background service or scheduled task to validate enterprise licenses for software suites (e.g., ERP or CRM systems) installed on Windows Server 2019/2022. A nightly job triggers the Themida wrapper to check license validity, triggering the YARA rule during the scan window.C:\Program Files\Oreans Technologies\LicenseManager\ThemidaWrapper.exe) within the detection engine’s allow-list configuration to ignore events occurring between 01:00 and 04:00 UTC.Scenario: Deployment of Virtual Desktop Infrastructure (VDI) Images
Build or Provisioning state.Scenario: Admin-Initiated Software Patching via SCCM