Thinstall25xxJtit

Hunt Hypothesis

This rule detects the presence of Thinstall-packed executables, a common obfuscation technique used by adversaries to hide malicious code and evade static analysis. Proactively hunting for these packed binaries in Azure Sentinel helps identify potentially compromised workloads or staging environments where attackers may be deploying obfuscated payloads to establish persistence or execute secondary stages.

YARA Rule

rule Thinstall25xxJtit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 [5] 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }
	$a1 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D ?? 1A 00 00 B9 ?? 1A 00 00 BA ?? 1B 00 00 BE 00 10 00 00 BF ?? 53 00 00 BD ?? 1A 00 00 03 E8 81 75 00 [5] 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 [4] 03 [23] 3B F1 7C 04 3B F2 7C 02 89 2E 83 C6 04 3B F7 7C E3 58 50 68 00 00 40 00 68 80 5A }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT administrators deploy older, unmanaged enterprise applications (e.g., specific versions of legacy CAD software or proprietary banking terminals) that were packaged using Thinstall to reduce file size, the resulting executable on endpoint machines will match the signature.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\LegacyApp\) or specific known-good hashes of the deployed installer executables.
• Scheduled Maintenance Jobs for Virtual Appliances: Many virtual appliance vendors (e.g., specific versions of backup agents, log shippers, or monitoring agents like older builds of Splunk Forwarder or SolarWinds agents) use Thinstall-packaged binaries for their service executables. These run as scheduled tasks or services on Windows Server hosts.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., svc_backup, agent_service) or executables located in vendor-specific directories (e.g., C:\Program Files\VendorName\Agent\bin\).
• Developer Test Environments and CI/CD Agents: In development or DevOps environments, engineers may use Thinstall to package test harnesses, custom build tools, or lightweight CI/CD runners (e.g., custom Jenkins plugins or Azure DevOps agents) to optimize disk space on build agents.
  • Filter/Exclusion: Exclude hosts tagged with env=dev or env=ci in your asset inventory, or exclude executables in user-specific build directories (e.g., C:\Users\<dev_user>\.build\ or D:\ci_agents\).
• Third-Party Plugin or Extension Binaries: Certain software suites (e.g., older versions of Adobe Creative Cloud plugins, specific IDE extensions, or hardware driver utilities) bundle Thinstall-compressed components that are extracted or executed