FSG v110 Eng dulekxt Microsoft Visual Cpp 60 70 ASM

Hunt Hypothesis

This rule identifies legacy executables compiled with older versions of Microsoft Visual C++ (6.0/7.0) using assembly language, a pattern often associated with aged malware or custom tools that may lack modern security features. Proactively hunting for these artifacts helps the SOC team surface potential low-severity threats or dormant backdoors that might evade standard behavioral detections due to their minimal footprint and outdated build characteristics.

YARA Rule

rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ASM: PEiD
{
    strings:
        $a = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Framework 1.1/2.0 Application Deployment: Many older enterprise line-of-business (LOB) applications or internal tools were compiled with Visual C++ 6.0 or 7.0 and may contain specific assembly structures that match this YARA signature. This often occurs during mass deployments via SCCM or Intune where the installer extracts binaries to C:\Program Files\... or user profile directories.

  • Filter/Exclusion: Exclude processes or files located in standard application installation paths (e.g., C:\Program Files\, C:\Program Files (x86)\) or known internal LOB application directories. Additionally, exclude if the parent process is a standard deployment agent like CCMSetup.exe or IntuneManagementExtension.exe.

• Older Version Control or Build Tool Artifacts: Developers or DevOps engineers using older versions of tools like Visual SourceSafe, early versions of Team Foundation Server clients, or legacy build scripts may have local caches or temporary build outputs that retain the specific C++ 6.0/7.0 assembly characteristics. These files often reside in user-specific temp folders or project directories.

  • Filter/Exclusion: Exclude files located in user-specific temporary directories (%TEMP%, C:\Users\<user>\AppData\Local\Temp) or known development workspace directories (e.g., C:\Users\<user>\Documents\Visual Studio, C:\src\). Consider excluding if the process is associated with known IDEs or build agents like msbuild.exe or devenv.exe.

• Legacy Driver or Hardware Utility Installation: Certain older hardware vendors (e.g., specific HP, Dell, or Logitech drivers from the 2005–2010 era) still ship with components compiled using older C++ runtimes. These are often installed during initial OS provisioning or