EXE Stealth 25

Hunt Hypothesis

This rule identifies executable files exhibiting stealthy characteristics, potentially indicating the presence of fileless malware or obfuscated payloads designed to evade standard signature-based detection. Proactively hunting for these indicators in Azure Sentinel allows the SOC to uncover hidden threats that may be persisting in memory or disk before they execute lateral movement or data exfiltration.

YARA Rule

rule EXE_Stealth_25: PEiD
{
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or operations engineer uses a legitimate cross-platform build tool like Go (Golang) or Rust to compile a native Windows executable. These toolchains often produce binaries with minimal metadata, stripped debug symbols, or specific section alignments that YARA rules targeting “stealth” characteristics (like missing version info or unusual section names) may flag.

  • Filter/Exclusion: Exclude files located in standard build output directories (e.g., C:\Users\<User>\go\bin\, C:\src\project\build\) or exclude files with specific compiler-generated names (e.g., *.exe created within the last 1 hour in a known development path).

• Scenario: An IT administrator runs a custom PowerShell script that uses Add-Type to compile a small C# helper class into a temporary DLL or EXE for a one-off task (e.g., parsing a complex log file or interacting with a legacy COM object). The resulting binary is often placed in the %TEMP% or %LOCALAPPDATA% directory and lacks standard digital signatures or version resources.

  • Filter/Exclusion: Exclude executables in %TEMP% or %LOCALAPPDATA% that are smaller than 100KB and were created within the last 15 minutes, or correlate with recent PowerShell Add-Type events in the ScriptBlock log.

• Scenario: A software vendor deploys a lightweight, unsigned installer or updater component (e.g., for Adobe Creative Cloud, VMware Tools, or Intel Driver & Support Assistant) that runs from a temporary extraction folder. These components are often stripped of metadata to reduce size and may reside in paths like C:\ProgramData\<Vendor>\Temp\ or C:\Windows\Temp\<Vendor>\.

  • Filter/Exclusion: Exclude files in `