IsPE32

Hunt Hypothesis

This rule identifies 32-bit Windows Portable Executable files, which are frequently used by adversaries to deploy legacy malware or exploit 32-bit process emulation techniques to evade modern 64-bit security controls. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect potential low-severity intrusions or staging activities that may indicate an attacker leveraging older binaries to maintain a foothold within the environment.

YARA Rule

rule IsPE32 : PECheck
{
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint16(uint32(0x3C)+0x18) == 0x010B
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Legacy 32-bit Application Deployment via Group Policy: When IT administrators deploy legacy 32-bit Windows applications (e.g., older versions of Adobe Acrobat, Java Runtime Environment, or specific banking clients) to endpoints via Group Policy Software Installation, the installer or the application binary itself is a PE32 executable. This is a standard, legitimate administrative task.

  • Filter/Exclusion: Exclude files located in standard installation directories such as C:\Program Files (x86)\ or specific known vendor paths (e.g., C:\Program Files (x86)\Java\). Additionally, whitelist the specific installer executables (e.g., setup.exe or install.exe) from known trusted publishers.

• Development and Testing of 32-bit Binaries: Developers and QA engineers frequently compile, debug, or test 32-bit (x86) versions of applications to ensure compatibility with older systems or specific hardware. This involves running 32-bit executables from development directories or temporary build folders.

  • Filter/Exclusion: Exclude paths associated with development environments, such as C:\Users\<User>\source\, C:\dev\, or C:\builds\. You can also whitelist common development tools that spawn 32-bit processes, such as msbuild.exe or dotnet.exe when targeting x86 architectures.

• Scheduled Maintenance Jobs for Legacy Services: Many enterprise services and scheduled tasks (e.g., log rotation scripts, database backup agents, or monitoring agents) still rely on 32-bit executables due to legacy dependencies or driver requirements. These jobs run periodically via Task Scheduler.

  • Filter/Exclusion: Whitelist the specific executable names and their full paths if they are known maintenance tools (e.g., C:\Program Files (x86)\BackupAgent\backup.exe).