Detects payload generated by exe2hex

Hunt Hypothesis

This rule detects adversaries utilizing the exe2hex utility to convert executable files into hexadecimal strings for covert data exfiltration or command-and-control communication. A proactive hunt is essential in Azure Sentinel because this technique often bypasses traditional signature-based defenses by disguising malicious payloads as benign text, allowing attackers to move laterally undetected within the cloud environment.

YARA Rule

rule Payload_Exe2Hex : toolkit {
	meta:
		description = "Detects payload generated by exe2hex"
		author = "Florian Roth"
		reference = "https://github.com/g0tmi1k/exe2hex"
		date = "2016-01-15"
		score = 70
	strings:
		$a1 = "set /p \"=4d5a" ascii
		$a2 = "powershell -Command \"$hex=" ascii
		$b1 = "set+%2Fp+%22%3D4d5" ascii
		$b2 = "powershell+-Command+%22%24hex" ascii
		$c1 = "echo 4d 5a " ascii
		$c2 = "echo r cx >>" ascii
		$d1 = "echo+4d+5a+" ascii
		$d2 = "echo+r+cx+%3E%3E" ascii
	condition:
		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• https://github.com/g0tmi1k/exe2hex
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects payload generated by exe2hex rule, including suggested filters and exclusions:

• Scenario: Automated Backup Script Execution

  • Context: A nightly scheduled task (Windows Task Scheduler) runs a custom PowerShell script that converts critical configuration files into hex format before archiving them to an off-site storage bucket. The script invokes exe2hex as part of the pipeline, triggering the rule every night at 02:00 AM.
  • Filter/Exclusion: Create an exclusion based on the Process Name (powershell.exe) and Command Line containing the string exe2hex, restricted to a specific Scheduled Task ID (e.g., \Microsoft\Windows\Backup\NightlyHexConversion). Alternatively, exclude the rule for traffic originating from the specific backup server hostname.

• Scenario: Software Deployment via SCCM/Intune

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) to deploy a new application update. The deployment package includes a pre-installation step where exe2hex is used to verify the integrity of the installer binary before execution on 50+ workstations simultaneously.
  • Filter/Exclusion: Exclude alerts where the Parent Process is ccmsetup.exe or intunagent.exe. Additionally, filter by User Context, ensuring the process runs under a known service account (e.g., DOMAIN\SCCM-Deploy-Svc) rather than interactive user accounts.

• Scenario: Digital Forensics and Incident Response

  • Context: The Security Operations Center (SOC) team manually initiates an investigation on a compromised endpoint. An analyst runs exe2hex locally to generate a hex dump of the suspicious process memory for offline analysis, causing the detection engine to