← Back to SOC feed Coverage →

Looks for MD5 API

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-24T09:00:00Z · Confidence: medium

Hunt Hypothesis

The detection rule identifies potential adversary use of the MD5 API, which may indicate attempts to hash data for obfuscation or exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover early-stage malicious activity that could evade traditional detection methods.

YARA Rule

rule MD5_API {
	meta:
		author = "_pusher_"
		description = "Looks for MD5 API"
		date = "2016-07"
	strings:
		$advapi32 = "advapi32.dll" wide ascii nocase
		$cryptdll = "cryptdll.dll" wide ascii nocase
		$MD5Init = "MD5Init" wide ascii
		$MD5Update = "MD5Update" wide ascii
		$MD5Final = "MD5Final" wide ascii
	condition:
		($advapi32 or $cryptdll) and ($MD5Init and $MD5Update and $MD5Final)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/crypto/crypto_signatures.yar