MinGW 32x Dll WinMain additional

Hunt Hypothesis

This rule identifies 32-bit Windows DLLs compiled with MinGW that contain a WinMain entry point, a characteristic often associated with custom or obfuscated malware payloads that deviate from standard PE structures. Proactively hunting for these artifacts helps the SOC team detect low-fidelity or legacy tooling that may be used for initial access or lateral movement, ensuring visibility into non-standard binaries that traditional signature-based detections might miss.

YARA Rule

rule MinGW_32x_Dll_WinMain_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy 32-bit C/C++ application compiled with MinGW (e.g., a custom internal reporting tool or a specific version of ffmpeg/libpng) is deployed to user workstations. If the developer inadvertently links against kernel32.dll or includes a WinMain entry point in a DLL that is loaded by a 64-bit host process, the YARA rule may flag the binary as suspicious due to the unusual combination of 32-bit MinGW artifacts and a WinMain symbol in a DLL context.

  • Filter/Exclusion: Exclude binaries located in known application directories (e.g., C:\Program Files (x86)\InternalTools\) or add a hash-based exclusion for the specific version of the tool. Alternatively, exclude files where the PE header indicates a DLL (IMAGE_FILE_DLL) and the entry point is not DllMain but WinMain, if this is a known quirk of the specific compiler version used.

• Scenario: An automated build pipeline or CI/CD agent (e.g., Jenkins, GitLab Runner, or TeamCity) compiles a 32-bit MinGW DLL on a Windows build server. The resulting artifact is temporarily stored in a shared network drive or local temp folder before being uploaded to an artifact repository. If the YARA rule scans the file system during the build process or post-build verification, it may detect the intermediate DLL file.

  • Filter/Exclusion: Exclude files located in common build/temporary directories (e.g., C:\temp, C:\builds, \\fileserver\artifacts\) or exclude files owned by service accounts used for CI/CD (e.g., svc-jenkins, gitlab-runner).

• Scenario: A developer or QA engineer runs a 32-bit MinGW-compiled test