ASProtectSKE21xdllAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the presence of the ASProtectSKE21.dll component developed by Alexey Solodovnikov, which is frequently associated with legitimate software but can also be leveraged by adversaries for process hollowing or DLL side-loading attacks. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to distinguish between benign usage and potential stealthy execution techniques that may evade standard signature-based defenses.

YARA Rule

rule ASProtectSKE21xdllAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ASProtectSKE21xdllAlexeySolodovnikov detection rule, including targeted filters and exclusions:

• Scenario: Deployment of Licensed Third-Party Software via SCCM/Intune

  • Context: Enterprise IT teams frequently deploy proprietary or licensed software (e.g., specialized CAD tools like AutoCAD, engineering simulation suites, or niche financial reporting apps) that utilize the ASProtect SDK for license enforcement and anti-tampering. When these applications are installed or updated via Microsoft Endpoint Configuration Manager (SCCM) or Intune, the SKE21xdll component is often extracted to a temporary directory before installation, triggering the YARA rule.
  • Filter/Exclusion: Create an exclusion based on the installation source path and process lineage. Exclude alerts where the parent process is ccmsetup.exe, msiexec.exe, or intuneagent.exe and the file location resides within standard installation directories (e.g., C:\Program Files\VendorName\ or C:\Windows\Temp).

• Scenario: Scheduled Maintenance of Digital Rights Management (DRM) Components

  • Context: Many enterprise content management systems and media players rely on ASProtect for DRM. A scheduled Windows Task (Task Scheduler) runs nightly to update license keys or validate integrity checks, which involves loading the SKE21xdll dynamic link library into memory. This routine activity often mimics the behavior of a new executable launch, causing the rule to fire during off-hours maintenance windows.
  • Filter/Exclusion: Implement a time-based filter combined with a process name exclusion. Exclude alerts generated between 02:00 and 05:00 (local time) where the triggering process is TaskScheduler.exe or specific known service execut