← Back to SOC feed Coverage →

ThemidaWinLicenseV1802OreansTechnologies

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-02T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of the Oreans Technologies license module (ThemidaWinLicense) on endpoints, which may indicate legitimate software usage or a potential supply chain compromise involving embedded licensing components. The SOC team should proactively hunt for this signature in Azure Sentinel to validate its expected deployment across the environment and rule out any anomalous instances that could serve as a foothold for adversaries leveraging trusted third-party binaries.

YARA Rule

rule ThemidaWinLicenseV1802OreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D [4] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the ThemidaWinLicenseV1802OreansTechnologies detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar