← Back to SOC feed Coverage →

PCGuardv303dv305d

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-19T11:00:00Z · Confidence: medium

Hunt Hypothesis

This YARA rule targets specific memory signatures associated with the PCGuardv303dv305d component, likely indicating the presence of a legacy or embedded protection mechanism that may be leveraged by adversaries for persistence or process injection. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity anomalies or dormant payloads that standard behavioral detections might miss, ensuring comprehensive coverage of the endpoint attack surface.

YARA Rule

rule PCGuardv303dv305d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 50 E8 [4] 5D EB 01 E3 60 E8 03 [3] D2 EB 0B 58 EB 01 48 40 EB 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar