ICE Archive Hint FILE START

Hunt Hypothesis

This rule identifies files containing specific header signatures associated with the ICE archive format, which adversaries may use to stage payloads or obfuscate data during initial access or lateral movement. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect early-stage staging activities or unusual file types that could indicate a foothold before the archive is extracted or executed.

YARA Rule

rule ICE_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 2D 6C 68 ?? 2D }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Windows Installer: When deploying older enterprise applications (e.g., specific versions of Adobe Creative Suite, older Microsoft Office components, or legacy ERP clients) that bundle resources in .ice or custom archive formats, the installer service (msiexec.exe) or the application’s self-extracting archive may write these files to disk.

  • Filter/Exclusion: Exclude files located in standard installation directories such as C:\Program Files\, C:\Program Files (x86)\, or C:\Windows\Installer\ where the parent process is msiexec.exe or a known vendor installer (e.g., setup.exe from a trusted vendor).

• Game or Media Asset Extraction: Enterprise environments with creative teams or IT labs may use tools like 7-Zip, WinRAR, or specialized game modding tools to extract assets from game files (e.g., .pak, .ice, or custom pack formats) into working directories.

  • Filter/Exclusion: Exclude files in user-specific working directories (e.g., C:\Users\<username>\Documents\, C:\Users\<username>\Downloads\, or C:\Temp\) where the parent process is a known archive utility (7z.exe, WinRAR.exe, tar.exe) or a creative suite application (e.g., Photoshop.exe, AfterEffects.exe).

• Scheduled Backup or Log Rotation Jobs: Some legacy backup agents or log rotation scripts may package logs or configuration files into custom archive formats that match the “ICE” hint signature, especially if the backup software uses non-standard compression headers.

  • Filter/Exclusion: Exclude files in backup or log directories (e.g., C:\Backup\, C:\Logs\, C:\var\log\) where the parent process is a known backup agent (e