Patch Creation Wizard v12 Seek and Destroy Patch additional

Hunt Hypothesis

This rule detects the presence of the Patch Creation Wizard v12 tool, which adversaries may use to craft or modify executable patches for stealthy deployment or persistence mechanisms. Proactively hunting for this artifact in Azure Sentinel allows the SOC to identify potential post-exploitation activities or tooling staging before they are leveraged for lateral movement or privilege escalation.

YARA Rule

rule Patch_Creation_Wizard_v12_Seek_and_Destroy_Patch_additional: PEiD
{
    strings:
        $a = { E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A 01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85 C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75 08 E8 63 05 00 00 68 5F 30 40 00 6A 65 FF 75 08 E8 5A 05 00 00 68 B0 30 40 00 6A 67 FF 75 08 E8 4B 05 00 00 68 01 31 40 00 6A 66 FF 75 08 E8 3C 05 00 00 6A 00 FF 75 08 E8 0E 05 00 00 A3 CA 39 40 00 C7 05 D2 39 40 00 2C 00 00 00 C7 05 D6 39 40 00 10 00 00 00 C7 05 DA 39 40 00 00 08 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 DD 04 00 00 C7 05 DA 39 40 00 00 00 00 00 C7 05 F6 39 40 00 00 30 40 00 C7 05 FA 39 40 00 01 00 00 00 68 D2 39 40 00 6A 01 6A FF FF 35 CA 39 40 00 E8 AB 04 00 00 EB 5F EB 54 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy .NET application (e.g., an internal HR portal or ERP system) uses the PatchCreationWizard library to generate hotfixes for client-side components during a routine software update cycle. The wizard’s “Seek and Destroy” module scans the local file system for specific DLLs to patch, triggering the YARA rule’s file access patterns.

  • Filter/Exclusion: Exclude processes running from the application’s specific installation directory (e.g., C:\Program Files\InternalHR\bin\) or exclude the specific parent process name (e.g., HRPortalUpdater.exe) if the YARA rule targets the child process.

• Scenario: An IT administrator manually runs the PatchCreationWizard GUI tool from a shared network drive or a jump box to create a custom patch for a bespoke internal tool. The tool spawns a helper process to scan the target directory, which matches the “Seek and Destroy” heuristic.

  • Filter/Exclusion: Exclude processes where the parent process is explorer.exe or cmd.exe/powershell.exe and the working directory is a known admin workspace (e.g., C:\Users\Admin\Tools\) or a mapped network drive (e.g., \\fileserver\share\patches\).

• Scenario: A scheduled maintenance job (e.g., a Task Scheduler entry named “Nightly Patch Build”) executes a script that invokes the Patch Creation Wizard to automate the generation of weekly security patches for a specific product line. The automated execution triggers the detection due to the consistent file scanning behavior.

  • Filter/Exclusion: Exclude processes spawned by svchost.exe (for Task Scheduler) or Taskeng.exe where the command line contains the specific wizard executable name (e.g., PatchWizard.exe) and the parent process is Taskeng.exe.