Visual Protect Visage

Hunt Hypothesis

This rule detects the presence of Visual Protect Visage, a commercial software protection tool often used by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this signature allows the SOC team to identify potentially hidden or protected executables within Azure Sentinel that may be leveraging commercial protection mechanisms to mask their true intent.

YARA Rule

rule Visual_Protect_Visage: PEiD
{
    strings:
        $a = { 55 8B EC 51 53 56 57 C7 05 ?? ?? ?? 00 00 00 00 00 68 ?? ?? ?? 00 FF 15 00 ?? ?? 00 A3 ?? ?? ?? 00 68 ?? ?? ?? 00 A1 ?? ?? ?? 00 50 FF 15 04 ?? ?? 00 A3 ?? ?? ?? 00 6A 00 FF 15 ?? ?? ?? 00 A3 ?? ?? ?? 00 8B 0D ?? ?? ?? 00 51 E8 ?? ?? 00 00 83 C4 04 89 45 FC 83 7D FC 00 74 03 FF 65 FC 5F 5E 5B 8B E5 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually installs or updates the Visual Protect Visage client on a workstation using the standard installer executable (VisageSetup.exe or similar) during a patching cycle.
  • Filter/Exclusion: Exclude processes where the parent process is a known installer (e.g., msiexec.exe, setup.exe) and the file path contains Visage or VisualProtect in the Program Files or Temp directory.
• Scenario: The Visual Protect Visage service (VisageService.exe or VisageAgent.exe) is restarted or re-initialized by a scheduled task or Group Policy Object (GPO) refresh that triggers a service restart command.
  • Filter/Exclusion: Exclude events where the parent process is services.exe or svchost.exe and the command line contains arguments like restart, reload, or start associated with the Visage service name.
• Scenario: A developer or QA engineer runs a local build or test script that launches the Visage client in a debug mode or with specific command-line flags (e.g., --debug, --log-level=verbose) for troubleshooting purposes.
  • Filter/Exclusion: Exclude processes where the command line contains debug-specific flags (--debug, -v, --verbose) and the working directory is a development folder (e.g., C:\Users\<User>\Projects, C:\dev, C:\src).
• Scenario: A backup agent (e.g., Veeam, Commvault, or Acronis) creates a snapshot or image of a volume containing the Visage installation directory, causing the Visage binary to be read or executed briefly during the backup verification phase.
  • Filter/Exclusion: Exclude processes where the parent process is