Data Beyond ImageSize Check

Hunt Hypothesis

This rule detects potential memory corruption or buffer overflow attempts where data extends beyond the expected image size, a technique often used by adversaries to execute arbitrary code or escalate privileges. Proactively hunting for this anomaly in Azure Sentinel allows the SOC to identify stealthy exploitation attempts or malformed payloads that may bypass standard integrity checks before they lead to a full system compromise.

YARA Rule

rule IsBeyondImageSize : PECheck
{
	meta: 
		author = "_pusher_"
		date = "2016-07"
		description = "Data Beyond ImageSize Check"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		for any i in (0..pe.number_of_sections-1):
		( 
		(pe.sections[i].virtual_address+pe.sections[i].virtual_size) > (uint32(uint32(0x3C)+0x50)) or
		(pe.sections[i].raw_data_offset+pe.sections[i].raw_data_size) > filesize
		)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Legacy Application Memory Mapping: Older .NET or Java applications may allocate memory buffers that exceed the reported ImageSize due to dynamic heap expansion or specific loader behaviors.
  • Filter: Exclude processes where the ImageSize is less than 10MB and the parent process is a known application server (e.g., java.exe, dotnet.exe, w3wp.exe).
• Just-In-Time (JIT) Compilation Overhead: The .NET JIT compiler generates native code at runtime, which can cause the actual committed memory or mapped sections to appear larger than the static PE header ImageSize suggests, especially in complex microservices.
  • Filter: Exclude processes named dotnet.exe or coreclr.exe if the parent process is a standard web server or API gateway (e.g., k8s.io, nginx.exe, iisexpress.exe).
• Driver or Kernel Module Loading: Some third-party security agents or virtualization drivers (e.g., VMware Tools, Hyper-V integration services) may load additional code sections or shadow copies that are not fully reflected in the standard user-mode ImageSize check.
  • Filter: Exclude processes associated with known virtualization or security tooling (e.g., vmtoolsd.exe, vmnet.exe, crowdagent.exe, carbonblack.exe) if the parent process is a system service (services.exe) or a known agent service.
• Shared Library Relocation: In environments using shared libraries (common in Linux containers or Wine on Windows), the effective code size may appear larger due to relocation tables or additional metadata sections that are not strictly part of the initial ImageSize calculation.
  • Filter: Exclude processes running within containerized environments (e.g., dockerd.exe, containerd-shim.exe, kubelet.exe)