MESSv120

Hunt Hypothesis

This rule detects the presence of the MESSv120 malware variant, which is often associated with initial access or persistence mechanisms in compromised environments. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity threats that may be used for lateral movement or data staging before they escalate into more impactful attacks.

YARA Rule

rule MESSv120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA B9 [2] F3 [2] E3 ?? EB ?? EB ?? B6 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A security team deploys a custom YARA scanning utility (e.g., yara-scan.exe or a wrapper script) that loads the MESSv120.yar file into memory to scan endpoint binaries. The rule triggers because the YARA compiler or scanner process holds the rule definition in memory, matching its own signature.
  • Filter/Exclusion: Exclude processes where the parent process is a known YARA scanner (e.g., yara.exe, yara-scan.ps1) or where the image path contains \yara\ or \security-tools\.
• Scenario: An IT administrator uses a text editor or IDE (e.g., Notepad++, VS Code, or Notepad++) to review or edit the MESSv120.yar file stored in a shared network drive (\\fileserver\security\rules\). The editor loads the file into memory, triggering the detection on the editor process.
  • Filter/Exclusion: Exclude processes where the image name is a known text editor (notepad.exe, code.exe, notepad++.exe) and the command line contains the specific rule filename (MESSv120.yar).
• Scenario: A CI/CD pipeline or automated build agent (e.g., Jenkins, Azure DevOps, or GitLab Runner) checks out the YARA rule repository and compiles the rules as part of a pre-deployment validation step. The build agent process (java.exe, node.exe, or msbuild.exe) loads the rule file into memory during the compilation phase.
  • Filter/Exclusion: Exclude processes where the parent process is a build agent or CI tool (e.g., jenkins.exe, agent.exe, node.exe) and the working directory or command line references the YARA repository path.