Overlay Check

Hunt Hypothesis

This rule detects potential UI overlay attacks where an adversary places a malicious window over a legitimate interface to trick users into interacting with the wrong element, a common tactic in phishing and credential theft scenarios. Proactively hunting for these overlays in Azure Sentinel helps identify subtle social engineering attempts that may bypass standard network-based detections by exploiting user trust and visual cues.

YARA Rule

rule HasOverlay : PECheck
{
	meta: 
		author="_pusher_"
		description = "Overlay Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//stupid check if last section is 0		
		//not (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x0 and

		(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) < filesize
		
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Remote Desktop Services (RDS) Session Management: When an administrator uses the built-in “Remote Desktop Services Manager” or third-party tools like BeyondTrust or Citrix Director to connect to a user session, the client-side overlay window (often used for session sharing or control) may be detected as a new top-level window or process overlay.
  • Filter/Exclusion: Exclude processes where the parent process is mstsc.exe (Microsoft Terminal Services Client) or CitrixReceiver.exe, and where the window class name matches known RDS overlay classes (e.g., RDPOverlay or CitrixOverlay).
• Screen Recording and Monitoring Agents: Enterprise endpoint monitoring tools such as TeamViewer, AnyDesk, LogMeIn, or ScreenConnect create persistent overlay windows for remote control cursors, chat bubbles, or status indicators. These are standard in IT support workflows.
  • Filter/Exclusion: Exclude windows associated with processes named TeamViewer.exe, AnyDesk.exe, ScreenConnect.exe, or logmein.exe. Additionally, filter out windows with specific class names like TVOverlay or AnyDeskOverlay that are known to be non-interactive UI elements.
• Virtual Desktop Infrastructure (VDI) Client Overlays: In environments using VMware Horizon or Citrix Virtual Apps and Desktops, the client application often displays a persistent toolbar or overlay for session management (e.g., disconnect, maximize, audio controls). These overlays are expected and legitimate.
  • Filter/Exclusion: Exclude processes vmware-view.exe or Udica.exe (Citrix). Filter windows where the parent process is a VDI client and the window style includes WS_EX_TOOLWINDOW (indicating a non-taskbar overlay) rather than a full application window.