MSLRHv032afakePCGuard4xxemadicius

Hunt Hypothesis

This detection identifies potential adversary activity involving fake PC Guard processes that may be executing malicious payloads to evade standard security controls. A proactive hunt is essential in Azure Sentinel to uncover these stealthy indicators early, preventing lateral movement or data exfiltration before they escalate into significant incidents.

YARA Rule

rule MSLRHv032afakePCGuard4xxemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the MSLRHv032afakePCGuard4xxemadicius YARA rule, which targets fake PC Guard/Emadicius malware behavior (often involving suspicious process injection or fileless execution patterns):

• Scenario: Microsoft Defender Antivirus Real-Time Protection Scans

  • Context: The MsMpEng.exe service performs aggressive real-time scanning of user documents and temporary files. When Defender scans a large archive or executable, it may spawn child processes that mimic the memory footprint and injection patterns flagged by the “fake PC Guard” logic.
  • Filter/Exclusion: Create an exclusion rule for the process MsMpEng.exe and its specific command line arguments containing /scan. Additionally, exclude the directory path C:\Program Files\Windows Defender from YARA scanning to prevent self-scanning noise.

• Scenario: Scheduled Group Policy Software Deployment (SCCM/Intune)

  • Context: During business hours, System Center Configuration Manager (SCCM) or Microsoft Intune pushes updates or new applications via the ccmexec.exe agent. These agents often inject code into user sessions to install software silently, triggering the rule’s detection of “unusual process creation” and “emulated execution.”
  • Filter/Exclusion: Exclude processes initiated by ccmexec.exe where the parent process is smss.exe (Session Manager). Add a time-based filter to suppress alerts for this specific rule between 09:00 and 17:00 on weekdays if the event source matches “Configuration Manager.”

• Scenario: Endpoint Detection and Response (EDR) Telemetry Collection

  • Context: Third-party EDR agents like CrowdStrike Falcon (csfalcon.exe) or Carbon Black (cbengine.exe) periodically collect telemetry