MinGW 32x main

Hunt Hypothesis

This rule identifies the presence of 32-bit executables compiled with the MinGW toolchain, a behavior often associated with lightweight, open-source malware or custom tooling that adversaries use to blend in with standard Windows environments. Proactively hunting for these artifacts allows the SOC to uncover potentially stealthy payloads or backdoors that may have been deployed to establish a foothold or execute post-exploitation tasks within the Azure Sentinel environment.

YARA Rule

rule MinGW_32x_main: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D }
        $b = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Build Toolchains in CI/CD Pipelines

  • Scenario: A continuous integration server (e.g., Jenkins, GitLab CI) compiles C/C++ applications for Windows 32-bit targets using the MinGW-w64 toolchain. The resulting executable (main.exe or similar) is generated in a temporary build directory (e.g., C:\jenkins\workspace\project\build\) and may be executed for smoke testing or unit tests.
  • Filter/Exclusion: Exclude paths containing jenkins, gitlab-runner, ci\build, or temp\build where the parent directory structure indicates a known CI/CD workspace. Additionally, allow if the process parent is a known build agent service (e.g., jenkins.exe, gitlab-runner.exe).

• Automated Patching or Maintenance Scripts

  • Scenario: An IT operations team uses a custom 32-bit MinGW-compiled utility (e.g., patch_apply.exe) to distribute and execute configuration changes or certificate renewals across a fleet of legacy Windows 7/Server 2008 R2 endpoints via a scheduled task or group policy script. The tool is stored in a shared admin share (e.g., \\fileserver\ops$\tools\) and copied to C:\ProgramData\OpsTools\ before execution.
  • Filter/Exclusion: Exclude if the file path matches C:\ProgramData\OpsTools\ or \\fileserver\ops$\tools\. Allow if the process is launched by Task Scheduler (svchost.exe with taskschd.dll loaded) or cmd.exe initiated by a known admin service account.

• Legacy Application Installers or Self-Extractors

  • Scenario: An older enterprise application (e