This YARA rule targets specific memory patterns associated with legacy Microsoft C runtime components, potentially indicating the presence of older or embedded code that adversaries might leverage for obfuscation or persistence. Proactively hunting for these signatures in Azure Sentinel helps identify systems running outdated or unusual binary structures that could serve as a foothold for lateral movement or privilege escalation.
rule Microsoft_C_19901992: PEiD
{
strings:
$a = { B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
msbuild.exe, vbc.exe, or csc.exe located in standard Visual Studio installation paths (e.g., C:\Program Files (x86)\Microsoft Visual Studio\...).wuauclt.exe or usoclient.exe) or third-party patch management tools (like SCCM/MECM) often write temporary C/C++ helper binaries or update packages to disk that may contain legacy compiler artifacts or specific version strings triggering the rule.
wuauclt.exe, usoclient.exe, or ccmexec.exe (Configuration Manager client), or files located in C:\Windows\SoftwareDistribution or C:\Windows\Temp.setup.exe, install.exe, or unins000.exe that are child processes of known installer engines (e.g., msiexec.exe, wuaex.exe) or are located in vendor-specific installation directories (e.g., C:\Program Files\VendorName\...).