Rich Signature Check

Hunt Hypothesis

This rule identifies executable files that contain a Rich header, a structure often added by Microsoft compilers that can be manipulated or stripped by adversaries to hide the true origin of a binary. Proactively hunting for these signatures helps the SOC team detect potentially tampered or obfuscated executables that may indicate fileless malware or advanced persistence mechanisms within the Azure environment.

YARA Rule

rule HasRichSignature : PECheck
{
	meta: 
		author = "_pusher_"
		description = "Rich Signature Check"
		date="2016-07"
	strings:	
		$a0 = "Rich" ascii
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		(for any of ($a*) : ($ in (0x0..uint32(0x3c) )))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a modern .NET build tool (e.g., dotnet build, msbuild, or csc.exe) to compile C# or VB.NET source code into an executable or DLL. The compiler automatically generates the Rich Header to store metadata about the assembly, such as the compiler version and timestamp, which is standard behavior for native .NET binaries.

  • Filter/Exclusion: Exclude processes where the parent process is a known compiler or build tool (e.g., csc.exe, vbc.exe, msbuild.exe, dotnet.exe) and the file path ends with .dll or .exe in a development or build directory (e.g., C:\Users\<user>\source\repos\, C:\builds\).

• Scenario: An enterprise application installer (e.g., msiexec.exe or a custom .exe installer like setup.exe from vendors like Adobe, Oracle, or Microsoft) writes a newly compiled or updated binary to disk. If the installer uses a .NET-based wrapper or if the underlying binary is a .NET assembly, the Rich Header will be present as part of the legitimate file structure.

  • Filter/Exclusion: Exclude events where the writing process is a known installer executable (e.g., msiexec.exe, setup.exe, install.exe) and the target file path is within a standard installation directory (e.g., C:\Program Files\, C:\Program Files (x86)\) or a vendor-specific temp folder.

• Scenario: A scheduled maintenance job or service (e.g., a custom .NET-based agent, monitoring tool, or backup utility) restarts or updates its own binary. For example, a .NET-based log rotation service or a custom telemetry agent may rewrite its executable or configuration DLL during a