Rule to detect DarkEYEv3 encrypted executables (often malware)

Hunt Hypothesis

DarkEYEv3 encrypted executables indicate potential malware presence, as this encryption method is commonly used by adversaries to evade detection and execute malicious payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced threats that may bypass traditional detection mechanisms.

YARA Rule

rule DarkEYEv3_Cryptor {
	meta:
		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
		author = "Florian Roth"
		reference = "http://darkeyev3.blogspot.fi/"
		date = "2015-05-24"
		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
		score = 55
	strings:
		$s0 = "\\DarkEYEV3-" 
	condition:
		uint16(0) == 0x5a4d and $s0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• http://darkeyev3.blogspot.fi/
• Source Rule

False Positive Guidance

• Scenario: A system administrator is using PEStudio or Dependency Walker to analyze a legitimate encrypted executable for debugging purposes.
  Filter/Exclusion: Exclude processes associated with known security tools (e.g., pestudio.exe, depends.exe) or use a filter based on the process name.

• Scenario: A scheduled job runs PowerShell scripts that use CertUtil to encrypt files as part of a secure data transfer process.
  Filter/Exclusion: Exclude processes initiated by scheduled tasks or filter based on the command line containing CertUtil or specific encryption flags.

• Scenario: A developer is using Visual Studio to compile a project that includes encrypted resources or obfuscated code for obfuscation purposes.
  Filter/Exclusion: Exclude processes with the parent process being devenv.exe or filter based on the presence of known obfuscation tools in the command line.

• Scenario: A backup job uses Veeam or Acronis to encrypt backup files using AES or similar encryption algorithms.
  Filter/Exclusion: Exclude processes associated with backup software (e.g., veeam.exe, acronisbackup.exe) or filter based on the file paths being in a known backup directory.

• Scenario: An IT admin is using BitLocker to encrypt drives, which may result in encrypted file system artifacts being flagged.
  Filter/Exclusion: Exclude processes related to BitLocker (bitlocker.exe) or filter based on file system operations that are known to be part of BitLocker encryption.