MingWin32 Dev Cpp v4991 h

Hunt Hypothesis

This hypothesis targets the presence of the Mingw32 Dev-C++ v4991 compiler header file, which may indicate the use of a specific, potentially outdated or legacy development toolchain on a host. Proactively hunting for this artifact helps the SOC team identify systems where adversaries might be compiling custom payloads or using known development environments to stage malicious code, thereby reducing the risk of undetected binary generation or persistence mechanisms.

YARA Rule

rule MingWin32_Dev_Cpp_v4991_h: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: Developers or IT staff maintaining legacy Win32 applications may open the v4991.h header file in a text editor (e.g., Notepad++, VS Code) or compile a small utility using the Dev-C++ IDE.
  • Filter/Exclusion: Exclude processes where the parent process is a known text editor (e.g., notepad.exe, code.exe, notepad++.exe) or the Dev-C++ compiler (g++.exe, gcc.exe) located in the Dev-C++ installation directory.
• Software Packaging and Deployment: System administrators using tools like WiX, NSIS, or Inno Setup to create installers for internal applications may include the Dev-C++ runtime or source files in the package structure, triggering the YARA rule during the staging or compression phase.
  • Filter/Exclusion: Exclude file paths located within common build or staging directories (e.g., C:\Builds\, C:\Temp\, C:\Users\Public\Builds\) or exclude processes associated with packaging tools (e.g., wix.exe, makensis.exe, ISCC.exe).
• Backup and Archive Operations: Backup agents (e.g., Veeam, Commvault, Windows Server Backup) or archiving tools (e.g., 7-Zip, WinRAR) may scan or extract files containing the v4991.h header from developer workstations or build servers.
  • Filter/Exclusion: Exclude processes associated with backup or archive software (e.g., wbadmin.exe, veeam.exe, 7z.exe, winrar.exe) and exclude file paths ending in common archive extensions (.zip, .rar, .7z, .tar).
• CI/CD Pipeline Build Agents: Continuous Integration/Continuous Deployment (