MSLRHv032afakeNeolite20emadicius

Hunt Hypothesis

This YARA rule targets specific memory patterns associated with the “Neolite” malware family, indicating potential in-memory execution or obfuscated code injection by an adversary. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity, stealthy threats that may evade traditional network-based detections and establish a foothold within the environment.

YARA Rule

rule MSLRHv032afakeNeolite20emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer runs a local build pipeline using Jenkins or Azure DevOps that compiles a C++ application with the MSVC compiler (cl.exe), generating a debug binary that includes specific symbol strings or version metadata matching the YARA pattern.
  • Filter/Exclusion: Exclude files located in standard build directories (e.g., C:\builds\, C:\workspace\) or files owned by the jenkins or azuredevops service accounts.
• Scenario: An IT administrator performs a manual patch deployment using SCCM (System Center Configuration Manager) or Intune, where the installer executable (e.g., setup.exe from a vendor like Adobe or Oracle) is temporarily staged in the C:\Windows\Temp or C:\Users\Public directory and contains embedded license keys or version strings that trigger the rule.
  • Filter/Exclusion: Exclude processes or files whose parent process is ccmexec.exe (SCCM agent) or IntuneManagementExtension.exe, or exclude known vendor installer paths (e.g., C:\Program Files\Adobe\, C:\Program Files\Oracle\).
• Scenario: A security team runs a vulnerability scanner like Nessus or Qualys that drops a small probe executable or script into the C:\ProgramData or C:\Windows\Temp folder to test local privilege escalation vectors, which may contain specific byte sequences or string patterns that mimic the YARA signature.
  • Filter/Exclusion: Exclude files created by processes named nessus.exe, qualys_agent.exe, or vulnscan.exe, and exclude paths under C:\ProgramData\Tenable\ or C:\Program Files\Qualys\.
• Scenario: