FSGv110EngdulekxtMicrosoftVisualC6070

Hunt Hypothesis

This detection identifies potential adversary activity involving the execution of Microsoft Visual C++ 6.0 components, which may indicate initial reconnaissance or the deployment of legitimate tools for code analysis and compilation within the environment. A proactive hunt is essential to distinguish between routine development operations and malicious attempts to leverage trusted system binaries for establishing persistence or executing custom payloads in Azure Sentinel.

YARA Rule

rule FSGv110EngdulekxtMicrosoftVisualC6070
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 [2] 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 }
	$a1 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 [3] EB 02 CD 20 03 D3 8D 35 F4 00 }
	$a2 = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 [2] 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
	$a3 = { F7 D8 40 49 EB 02 E0 0A 8D 35 80 [3] 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 }
	$a4 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FSGv110EngdulekxtMicrosoftVisualC6070 detection rule, which targets Microsoft Visual C++ runtime components often associated with legitimate enterprise operations:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Symantec Endpoint Protection, or Microsoft Defender for Endpoint) frequently utilize the msvcp60.dll or related Visual C++ libraries as a dependency when executing background definition update tasks. These updates often trigger file integrity checks that mimic the behavior of new runtime installations.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is the specific AV service (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\ProgramData\Microsoft\MSC\Antivirus\MsMpEng.exe) and the file path contains \Microsoft Visual C++ 6.0\.

• Scenario: Automated Patch Deployment via Configuration Management

  • Context: IT Operations teams using tools like Microsoft System Center Configuration Manager (SCCM) or Ansible Tower often push cumulative updates that include legacy Visual C++ redistributables to ensure application compatibility across the fleet. These deployments run as scheduled tasks during maintenance windows, triggering the rule when the installer writes new runtime binaries.
  • Suggested Filter/Exclusion: Create a whitelist for process names matching ccmsetup.exe or Ansible Runner where the command line arguments contain keywords like /quiet, /norestart, or specific package IDs related to “Visual C++ Redistributable”.

• Scenario: Legacy Line-of-Business (LOB) Application Startup

  • Context: Many critical enterprise applications (e.g., SAP GUI, Oracle Forms, or custom