← Back to SOC feed Coverage →

NSFree code features

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-26T23:00:00Z · Confidence: medium

Hunt Hypothesis

The NSFree code features rule detects potential adversary use of obfuscated or packed code to evade detection, which may indicate the presence of malicious payloads. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced threats that leverage code obfuscation techniques.

YARA Rule

rule NSFreeCode : NSFree Family 
{
    meta:
        description = "NSFree code features"
        author = "Seth Hardy"
        last_modified = "2014-06-24"
    
    strings:
        // push vars then look for MZ
        $ = { 53 56 57 66 81 38 4D 5A }
        // nops then look for PE\0\0
        $ = { 90 90 90 90 81 3F 50 45 00 00 }
    
    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_NSFree.yar