ZCodeWin32PEProtectorv101

Hunt Hypothesis

This rule identifies the presence of ZCode Win32 PE Protector, a commercial code obfuscation tool often leveraged by adversaries to mask malicious payloads and evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to detect potentially obfuscated executables on endpoints before they are executed or further manipulated, reducing the risk of stealthy malware deployment.

YARA Rule

rule ZCodeWin32PEProtectorv101
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 12 00 00 00 [12] E9 FB FF FF FF C3 68 [4] 64 FF 35 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Packaging and Deployment

  • Scenario: Enterprise IT teams use commercial installers or deployment tools (e.g., Advanced Installer, InstallShield, or WiX Toolset) to package applications. These tools often employ PE protection or packing techniques to optimize size, enforce licensing, or protect intellectual property, which can match the ZCodeWin32PEProtector signature.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that are signed by known vendor certificates (e.g., Microsoft Corporation, Advanced Installer, InstallShield). Alternatively, exclude files with specific extensions like .msi, .msp, or .exe in C:\Windows\Installer\ or C:\ProgramData\Package Cache\.

• Antivirus/EDR Self-Protection and Update Binaries

  • Scenario: Security vendors (e.g., CrowdStrike, Carbon Black, Trend Micro, Symantec) frequently pack their own update binaries, driver files, or agent executables to prevent tampering and reduce memory footprint. These packed binaries may reside in system directories or temporary update folders and trigger the PE protector detection.
  • Filter/Exclusion: Exclude files signed by major security vendors (e.g., CrowdStrike, Inc., Trend Micro, Inc., Symantec Corporation) located in vendor-specific directories (e.g., C:\Program Files\CrowdStrike\, C:\Program Files (x86)\Trend Micro\). Also, exclude files in C:\Windows\Temp\ or C:\ProgramData\ if they are created by known security service processes (e.g., FalconSensor.exe, `T