MEW 11

Hunt Hypothesis

This rule detects the execution of the Microsoft Edge WebView2 (MEW) process, which adversaries frequently leverage to run malicious payloads or perform web-based attacks within trusted application contexts. Proactively hunting for this activity allows the SOC team to identify potential initial access or lateral movement attempts that exploit the ubiquity of the Edge runtime in Azure Sentinel environments.

YARA Rule

rule mew_11_xx : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="25/03/2013"
		description="MEW 11"

	strings:
		$signature1={50 72 6F 63 41 64 64 72 65 73 73 00 E9 [6-7] 00 00 00 00 00 00 00 00 00 [7] 00}
		$signature2="MEW"

	condition:
		$signature1 and $signature2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Windows Update Service (WaaSMonitor) Execution: The Windows Update Agent often executes wuaexer.exe or related binaries from C:\Windows\System32 or C:\Windows\Temp to check for and install updates. This is a standard background task that can mimic malicious web shell or script execution patterns if the rule inspects process origins or command lines.
  • Filter/Exclusion: Exclude processes where the parent process is svchost.exe (specifically the WaaSMonitor service) or where the image path is C:\Windows\System32\wuaexer.exe.
• PowerShell Script Execution via Scheduled Tasks: IT administrators frequently use schtasks to run PowerShell scripts (e.g., powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\DailyBackup.ps1) for maintenance tasks like log rotation, database backups, or compliance checks. These scripts often reside in shared network drives or local admin directories, which may trigger “suspicious script execution” detections.
  • Filter/Exclusion: Exclude powershell.exe processes where the command line contains -File or -Command and the script path matches known admin directories (e.g., C:\Admin\Scripts\, \\fileserver\IT\Scripts\) or is invoked by Task Scheduler (svchost.exe or taskschd.exe as parent).
• Antivirus/Endpoint Detection & Response (EDR) Scanner Operations: Security tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often execute their own scanning engines or update components from temporary directories or specific service paths. These processes may spawn child processes that execute scripts or binaries in ways that resemble web shell activity or unauthorized code execution.
  • Filter/Exclusion: Exclude processes where the parent process belongs to known EDR