EnigmaProtectorv112LITE

Hunt Hypothesis

This hypothesis targets the presence of Enigma Protector v1.12 LITE, a commercial software packer often abused by threat actors to obfuscate malicious payloads and evade static analysis. Proactively hunting for this specific version in Azure Sentinel allows the SOC to identify potentially hidden or disguised executables that may be leveraging known packer characteristics to bypass standard detection mechanisms.

YARA Rule

rule EnigmaProtectorv112LITE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED [3] 00 [31] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a local build pipeline or CI/CD agent (e.g., Jenkins, GitHub Actions self-hosted runner) that compiles C/C++ code using the Enigma Protector v1.12 LITE version for code obfuscation or license protection during the packaging phase.
  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, python.exe, node.exe) or where the file path resides in standard build directories (e.g., C:\builds\, D:\ci-cd\, C:\jenkins\workspace\).
• Scenario: An IT administrator uses a legacy internal tool or a specific vendor’s installer (e.g., a proprietary ERP module or financial software) that bundles the Enigma Protector v1.12 LITE binary to protect its executable from reverse engineering, and the tool is launched via a scheduled task or service.
  • Filter/Exclusion: Exclude files located in specific vendor directories (e.g., C:\Program Files\VendorName\, C:\Program Files (x86)\LegacyApp\) or exclude processes spawned by known service control managers (services.exe) or task scheduler (svchost.exe with specific task names).
• Scenario: A QA or security testing team runs a dynamic analysis or fuzzing harness that loads the Enigma Protector v1.12 LITE-protected binary in a sandboxed environment or isolated VM for testing purposes, often using debuggers or memory scanners.
  • Filter/Exclusion: Exclude processes where the parent process is a debugger or analysis tool (e.g., x64dbg.exe, ida64.exe, windbg.exe, fuzzing_harness.exe) or where the process is running