TrainerCreationKitv5Trainer

Hunt Hypothesis

This hypothesis targets the presence of TrainerCreationKit v5, a tool commonly used by threat actors to create custom Windows installers or trainers, which may indicate an adversary is preparing to deploy software or establish a foothold on endpoints. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify potentially compromised systems or staging environments before the tool is executed to install malicious payloads or modify system configurations.

YARA Rule

rule TrainerCreationKitv5Trainer
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses the TrainerCreationKit (TCK) v5 to generate a custom Windows installer for a new internal application during a release cycle. The TCK executable and its associated DLLs are copied to a developer’s workstation or build server, triggering the YARA signature.

  • Filter/Exclusion: Exclude files located in specific development directories (e.g., C:\Projects\InternalApp\Build\ or C:\Users\dev\TCK\) or exclude processes spawned by known build tools like msbuild.exe or dotnet.exe when the parent process is a recognized IDE (e.g., devenv.exe, code.exe).

• Scenario: An IT administrator uses TCK to create a standalone installer for a legacy line-of-business application that must be deployed to machines without internet access. The TCK kit is temporarily placed in a shared network folder (\\fileserver\apps\legacy\) for distribution.

  • Filter/Exclusion: Exclude paths under known application distribution shares (e.g., \\fileserver\apps\, \\dist\installers\) and exclude files with extensions .exe or .dll that are older than 7 days (indicating a one-time deployment rather than active development) or are located in read-only network shares.

• Scenario: A security engineer is testing a new detection rule or verifying the integrity of a signed installer by running the TCK-generated installer in a sandboxed VM or a dedicated test lab environment. The YARA rule scans the memory or disk of the test machine.

  • Filter/Exclusion: Exclude hosts that are tagged in CMDB/Asset Inventory as “Test Lab,” “Sandbox,” or “Dev-Test” environments. Alternatively, exclude processes running under a dedicated service account (e.g., svc_testlab) or