PassEXEv20

Hunt Hypothesis

This YARA rule detects the presence of Pass-the-Hash (PtH) executable artifacts, indicating an adversary is likely leveraging stolen credential hashes to authenticate without a password. Proactively hunting for these specific binaries in Azure Sentinel allows the SOC to identify lateral movement attempts and unauthorized access before they escalate to privilege escalation or data exfiltration.

YARA Rule

rule PassEXEv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 1E 0E 0E 07 1F BE [2] B9 [2] 87 14 81 [3] EB ?? C7 [3] 84 00 87 [3] FB 1F 58 4A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or sysadmin uses a custom PowerShell script to generate a self-extracting archive (SFX) or a password-protected executable wrapper for distributing a small internal tool. The script explicitly sets the PASSWORD attribute or embeds a password string in the PE header/metadata, triggering the YARA rule.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains arguments like -Pass, -Password, or Set-ItemProperty targeting System.Security.Cryptography. Alternatively, whitelist specific script paths under C:\Scripts\InternalTools\.
• Scenario: An IT operations team uses a legitimate enterprise deployment tool (e.g., SCCM, Intune, or a custom Ansible playbook) to push a password-protected MSI or EXE to endpoints. The deployment agent (e.g., ccmexec.exe or msiexec.exe) creates a temporary password-protected executable in the %TEMP% or %APPDATA% directory during the installation phase.
  • Filter/Exclusion: Exclude files located in standard temporary directories (%TEMP%, %TMP%, C:\Windows\Temp) if the parent process is a known deployment agent (ccmexec.exe, msiexec.exe, intunecompanion.exe). Add a path exclusion for C:\Windows\Installer\ and C:\ProgramData\Microsoft\Intune\.
• Scenario: A security team performs a periodic vulnerability scan or malware simulation using a tool like Metasploit, Cobalt Strike, or a custom YARA-based scanner that generates test executables with embedded passwords to verify detection coverage. These test files are created in a dedicated sandbox or test directory.
  • Filter/Exclusion: Exclude files created by processes with names like `msf