Enigma Protector v112 LITE

Hunt Hypothesis

This hypothesis targets the use of Enigma Protector v112 LITE, a commercial obfuscation tool frequently leveraged by adversaries to mask malicious payloads and evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify potentially compromised workstations or servers where attackers have deployed obfuscated binaries to hide their presence and execution logic.

YARA Rule

rule Enigma_Protector_v112_LITE: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Licensing and Protection: Developers or IT teams may use Enigma Protector to obfuscate proprietary commercial applications (e.g., custom billing software, internal CRM tools) to protect intellectual property or enforce licensing checks.
  • Filter/Exclusion: Exclude processes where the parent executable is a known application installer or updater (e.g., msiexec.exe, setup.exe from specific vendor directories) or where the file path resides in standard application installation directories (e.g., C:\Program Files\VendorName\) rather than temporary or user-specific folders.
• Game Modding and Anti-Cheat Utilities: In environments where gaming or simulation software is deployed (e.g., engineering firms using CAD/3D modeling tools or game development studios), Enigma Protector is often used to protect mod loaders, anti-cheat modules, or proprietary plugin binaries.
  • Filter/Exclusion: Exclude files located in game-specific directories (e.g., C:\Games\, C:\Steam\) or where the process name matches known modding tools (e.g., ModLoader.exe, AntiCheat.exe) and the user context is a non-administrative service account or a specific “Gaming” or “Dev” AD group.
• Scheduled Backup or Utility Jobs: Some third-party backup agents, disk defragmenters, or data compression utilities may use Enigma Protector to obfuscate their helper executables to prevent tampering or to reduce file size.
  • Filter/Exclusion: Correlate with scheduled task logs (schtasks or Task Scheduler events) to exclude executions triggered by known backup or maintenance jobs (e.g., VeeamBackup.exe, AcronisTrueImage.exe) or where the working directory is a known utility folder (e.g., C:\ProgramData\VendorUtilities\).