FSGv110EngbartxtWatcomCCEXE

Hunt Hypothesis

This detection identifies the execution of Watcom C compiler binaries (watcomc.exe) that may indicate an adversary leveraging legitimate build tools to compile custom malware or obfuscate malicious payloads within the environment. A proactive hunt is essential in Azure Sentinel to distinguish these benign compilation activities from potential supply chain compromises where attackers abuse trusted development utilities to establish persistence or evade signature-based detection.

YARA Rule

rule FSGv110EngbartxtWatcomCCEXE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 03 ?? 8D ?? 80 [2] 00 [9] EB 02 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv110EngbartxtWatcomCCEXE detection rule, along with recommended filters and exclusions:

• Scenario 1: Scheduled Antivirus Engine Updates

  • Context: The enterprise uses Symantec Endpoint Protection (SEP) or McAfee ePO, which triggers the watcomcc.exe compiler process during nightly scheduled updates to recompile signature definitions. This often occurs between 02:00 and 04:00 UTC on domain-joined servers.
  • Filter/Exclusion: Create a time-based exclusion for the rule execution window (e.g., 02:00–05:00) specifically for the process path C:\Program Files\Symantec Endpoint Protection\Bin\watcomcc.exe. Alternatively, exclude events where the parent process is Symantec Antivirus Client (rtvsc.exe).

• Scenario 2: Legacy Application Deployment via SCCM

  • Context: During a mass deployment of a legacy financial application (e.g., SAP NetWeaver or custom .NET wrappers) using Microsoft Endpoint Configuration Manager (SCCM), the installer invokes watcomcc.exe to compile runtime components on thousands of workstations simultaneously. This is often triggered by the “Software Center” service (Appdmg.exe).
  • Filter/Exclusion: Implement a parent-process filter that excludes alerts where the parent process name matches Appdmg.exe or SMS_EXECUTIVE. Additionally, exclude file paths containing \SCCM\ContentLib\ to isolate deployment traffic.

• Scenario 3: Automated Build Pipelines on CI/CD Agents

  • Context: Internal DevOps teams utilize Jenkins or Azure DevOps agents running