← Back to SOC feed Coverage →

MS Run Time Library 1987 additional

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-26T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets the presence of legacy Microsoft Run Time Library 1987 binaries, which adversaries may leverage for fileless execution or to establish a persistent foothold through outdated, rarely updated system components. Proactively hunting for these artifacts in Azure Sentinel helps identify potential low-and-slow persistence mechanisms or supply chain compromises that standard modern detection rules might miss due to their age and low severity classification.

YARA Rule

rule MS_Run_Time_Library_1987_additional: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/peid.yar