ASProtectv11MTE

Hunt Hypothesis

This rule detects the presence of executable files packed with ASProtect v11, a commercial packer frequently abused by threat actors to obscure malicious code and evade static analysis. Proactively hunting for this signature allows the SOC to identify potentially compromised endpoints or staging areas where adversaries are using known packing techniques to hide their payloads within the Azure environment.

YARA Rule

rule ASProtectv11MTE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 [4] 91 78 79 79 79 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legacy .NET Applications Compiled with ASProtect

  • Context: Many older enterprise line-of-business (LOB) applications, particularly those built in the mid-2000s to early 2010s, were compiled using ASProtect v11 to protect intellectual property. These executables often reside in application server directories or client install folders and are executed regularly by service accounts or user sessions.
  • Filter/Exclusion: Exclude files located in known application directories (e.g., C:\Program Files\*, C:\Program Files (x86)\*) where the file extension is .exe or .dll and the file size is less than 50MB. Additionally, exclude paths containing specific legacy application names (e.g., *LegacyApp*, *OldERP*) if identified during asset inventory.

• Scenario: Scheduled Backup or Maintenance Scripts

  • Context: Some IT operations teams use custom, obfuscated PowerShell or C# scripts wrapped in ASProtect to perform nightly database backups, log rotations, or certificate renewals. These scripts are often stored in C:\Scripts or C:\Maintenance and executed via Task Scheduler under the SYSTEM or LocalService account.
  • Filter/Exclusion: Exclude executions where the parent process is Task Scheduler (taskschd.msc or svchost.exe with specific service names) and the file path matches C:\Scripts\* or C:\Maintenance\*. Alternatively, whitelist specific file hashes (SHA256) of known maintenance scripts to avoid re-detecting them on every execution.

• Scenario: Third-Party Plugin or Add-on Binaries

  • Context: Certain third-party plugins for enterprise software (e.g., Jira, Confluence, or specific