This hypothesis targets the presence of the EXECryptor V2X SoftComplete development build, a specific variant of the EXECryptor ransomware family often used for initial encryption operations or testing. Proactively hunting for this signature allows the SOC to identify early-stage ransomware activity or developer artifacts before they progress to widespread encryption, mitigating potential data loss in the Azure environment.
rule EXECryptor_V2X_SoftComplete_Developement: PEiD
{
strings:
$a = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
C:\BuildAgents\, D:\CI\) or exclude processes named MSBuild.exe and vstest.console.exe when the parent process is dotnet.exe or msbuild.exe.csc.exe) or dotnet build for quick admin tasks may retain development-specific metadata that matches the YARA signature.
AppData\Local\Temp or specific internal tool directories (e.g., C:\Tools\InternalUtils\) if the file age is less than 7 days and the size is under 5MB.Task Scheduler jobs) that run legacy .NET console applications for log rotation, database backups, or report generation can trigger the rule if the binary was compiled in a development environment and not fully stripped of debug symbols.
schtasks.exe or Task Scheduler service if the executable path contains keywords like maintenance, backup, or report and the parent process is svchost.exe (specifically the Schedule service).