ARMProtectorv01bySMoKE

Hunt Hypothesis

This rule detects the execution of ARMProtector, a lightweight Windows process injector that leverages the ARM architecture to bypass traditional x86-based security controls and hide malicious payloads in memory. Proactively hunting for this behavior is critical because its use of non-standard instruction sets allows adversaries to achieve stealthy code injection and persistence, often evading standard endpoint detection tools that primarily monitor x86 process creation.

YARA Rule

rule ARMProtectorv01bySMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer is manually testing ARM-based container images or microservices on a hybrid x86/ARM cluster (e.g., using Docker with --platform=linux/arm64 or running QEMU user-mode emulation). The YARA rule may match the specific binary structure or import table of the ARM executable during the build or runtime inspection phase.

  • Filter/Exclusion: Exclude files located in specific build directories (e.g., C:\Builds\arm64\, /opt/containers/arm/) or exclude processes spawned by container runtimes like dockerd, containerd-shim, or qemu-aarch64.

• Scenario: An IT administrator is deploying a new ARM-based IoT device or edge gateway (e.g., Raspberry Pi CM4, NVIDIA Jetson, or Azure Stack Edge) and is using a standard x86 management agent (like a custom PowerShell script or a C# tool) to push configuration profiles or firmware updates. The management tool might load an ARM-specific helper library or DLL that matches the YARA signature.

  • Filter/Exclusion: Exclude processes initiated by known management tools such as PowerShell.exe (when the command line contains keywords like Deploy, Config, or Firmware) or specific management agents like SCCMClient.exe or IntuneManagementExtension.exe.

• Scenario: A security team is performing a periodic audit of third-party ARM-based SDKs or libraries (e.g., ARM NEON optimization libraries, CUDA for ARM, or specific AI inference engines like ONNX Runtime for ARM) that are stored in a shared network drive or local cache for future integration. The YARA scan picks up these static binaries during the file integrity check.

  • Filter/Exclusion: Exclude files in known SDK or library cache directories (e.g., `C:\