EncryptPE V22007121 WFS SignByfly additional

Hunt Hypothesis

This rule identifies executable files that have been packed or obfuscated using the EncryptPE tool, a technique frequently employed by adversaries to hide malicious code from static analysis and evade signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to uncover dormant or stealthy payloads that may have been introduced via web shells or file downloads, ensuring that obfuscated threats are detected before they can execute their intended logic.

YARA Rule

rule EncryptPE_V22007121_WFS_SignByfly_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 37 2E 31 32 2E 31 2C 20 43 6F 70 79 72 69 67 68 74 20 28 43 29 20 57 46 53 00 00 48 6F 6D 65 50 61 67 65 3A 20 77 77 77 2E 65 6E 63 72 79 70 74 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a local build script that uses a custom wrapper or a specific version of signcode/signtool to apply a “SignByfly” certificate to a newly compiled executable before it is pushed to the artifact repository. The YARA rule may match the specific byte pattern of the PE header or the embedded signature block created by this specific signing workflow.

  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe, powershell.exe, or bash.exe and the command line contains arguments related to signing (e.g., /sign, sign, cert, pfx) or where the file path resides in a known build directory (e.g., C:\Builds\, D:\Artifacts\).

• Scenario: An IT administrator performs a manual patch deployment using a custom internal tool or a modified version of msiexec or a proprietary installer that utilizes the “SignByfly” cryptographic provider for integrity verification during the installation phase. The tool may temporarily load a PE file with this specific signature structure into memory or on disk.

  • Filter/Exclusion: Exclude events where the user account belongs to a specific service group (e.g., svc-patch-deploy) or where the process name matches known internal deployment tools (e.g., internal-installer.exe, patch-agent.exe).

• Scenario: A security team runs a recurring vulnerability scan or binary analysis job using a tool like PEiD, Detect It Easy, or a custom Python script that loads PE files to inspect their headers and signatures. If the scanner enumerates or opens a file that has been previously signed with the “SignByfly” certificate, the YARA rule may trigger on the file object in memory or on disk.

  • Filter/Exclusion: Exclude processes where the