This hypothesis targets the presence of legacy Microsoft Run Time Library 1987 binaries, which adversaries may leverage for fileless execution or to establish a persistent foothold through outdated, rarely updated system components. Proactively hunting for these artifacts in Azure Sentinel helps identify potential low-and-slow persistence mechanisms or supply chain compromises that standard modern detection rules might miss due to their age and low severity classification.
rule MS_Run_Time_Library_1987_additional: PEiD
{
strings:
$a = { B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92 }
condition:
$a at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy .NET Framework 1.0/1.1 Application Deployment: Organizations maintaining legacy line-of-business applications (e.g., older versions of SAP GUI, specific medical billing software, or legacy ERP modules) often rely on the original mscorwks.dll or early mscoree.dll versions. When these applications are deployed via Group Policy or manual installation on Windows Server 2008 R2 or Windows 7 endpoints, the YARA rule may match the specific byte patterns of the 1987-era runtime library.
C:\Program Files\LegacyApp\bin\) or exclude processes where the parent process is a known installer (msiexec.exe) or a legacy service host.Visual Studio 2005/2008 Build Agents: Continuous Integration (CI) build servers or developer workstations running Visual Studio 2005 or 2008 for legacy C# projects will load the .NET 1.0/1.1 runtime assemblies during compilation or testing. The YARA rule might trigger on the mscorwks.dll or mscoree.dll loaded in memory or on disk during the build process.
C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\) or exclude processes named msbuild.exe, vstest.console.exe, or devenv.exe that are loading these specific DLLs.Legacy Java/.NET Interop Bridges (e.g., IKVM, Mono): Some enterprise environments use interop layers like IKVM (which allows .NET assemblies to run on the JVM) or older Mono implementations that may bundle or reference early .