Check FindWindowA iat

Hunt Hypothesis

The detection rule identifies potential adversary use of the FindWindowA function by inspecting the Import Address Table, which may indicate process injection or persistence techniques. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect early-stage malware or advanced threats leveraging Windows API calls for lateral movement or stealthy execution.

YARA Rule

rule Check_FindWindowA_iat {

	meta:
		Author = "http://twitter.com/j0sm1"
		Description = "it's checked if FindWindowA() is imported"
		Date = "20/04/2015"
		Reference = "http://www.codeproject.com/Articles/30815/An-Anti-Reverse-Engineering-Guide#OllyFindWindow"

	strings:
		$ollydbg = "OLLYDBG"
		$windbg = "WinDbgFrameClass"

	condition:
		pe.imports("user32.dll","FindWindowA") and ($ollydbg or $windbg)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legitimate application using FindWindowA to interact with a known window class (e.g., Notepad++ or PowerShell).
  Filter/Exclusion: process.name == "notepad++.exe" or process.name == "powershell.exe"

• Scenario: A system update or patching tool (e.g., Windows Update or Chocolatey) using FindWindowA to locate a UI element during installation.
  Filter/Exclusion: process.name == "wuauclt.exe" or process.name == "choco.exe"

• Scenario: A scheduled task running a GUI-based script (e.g., AutoIt or VBScript) that interacts with a window during automation.
  Filter/Exclusion: process.name == "autoit3.exe" or process.name == "wscript.exe"

• Scenario: A legitimate admin task like Task Scheduler or Group Policy using FindWindowA to manage or monitor a UI element.
  Filter/Exclusion: process.name == "taskhost.exe" or process.name == "gpedit.msc"

• Scenario: A third-party application (e.g., Wireshark or Process Monitor) using FindWindowA to monitor or interact with system windows.
  Filter/Exclusion: process.name == "wireshark.exe" or process.name == "procmon.exe"