IsPE64

Hunt Hypothesis

This rule identifies 64-bit Portable Executable files, which are the standard format for modern Windows binaries and a common vehicle for deploying malicious payloads or legitimate software. Proactively hunting for these artifacts allows the SOC to establish a baseline of expected 64-bit executables and detect anomalous or unexpected PE64 files that may indicate staged implants, dropped tools, or newly deployed components within the environment.

YARA Rule

rule IsPE64 : PECheck
{
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint16(uint32(0x3C)+0x18) == 0x020B
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Microsoft Defender for Endpoint (MDE) Agent Updates: The MDE service (MsMpEng.exe) or the Windows Update service (wuauclt.exe) may temporarily write or stage 64-bit PE executables (such as MpSigStub.exe or new driver binaries) to disk during signature or component updates.
  • Filter: Exclude processes where the parent process is MsMpEng.exe or svchost.exe (specifically the wuauserv or dcomlaunch groups) and the file path resides in C:\ProgramData\Microsoft\Windows Defender\ or C:\Windows\Temp\.
• Visual Studio Build Artifacts: When developers compile C++ or C# projects using Visual Studio, the build system (MSBuild.exe or dotnet.exe) generates 64-bit PE executables (.exe files) in the bin\Debug or bin\Release directories.
  • Filter: Exclude files located under standard development directories like C:\Users\<User>\source\, C:\Projects\, or C:\Builds\ where the parent process is MSBuild.exe, dotnet.exe, or devenv.exe.
• Application Installer Staging (e.g., Chrome, Slack, Teams): Modern installers (like chrome.exe installer, slack.exe installer, or teams.exe installer) often extract 64-bit PE executables to temporary folders (%TEMP% or %LOCALAPPDATA%) before moving them to the final installation directory.
  • Filter: Exclude files in %TEMP% or %LOCALAPPDATA%\Temp where the parent process name matches known installer binaries (e.g., chrome.exe, slack.exe, teams.exe, msiexec.exe) and the