PerlApp 602 ActiveState

Hunt Hypothesis

This hypothesis targets the presence of ActiveState Perl installations, which adversaries may leverage to execute scripts or maintain persistence through a less common scripting runtime. Proactively hunting for this indicator helps identify potential footholds or staging environments that rely on legacy or niche software to evade standard PowerShell or batch file detections.

YARA Rule

rule PerlApp_602_ActiveState: PEiD
{
    strings:
        $a = { 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55 }
        $b = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance (ActiveState PPM/PPM2)

  • Scenario: An IT operations engineer manually runs the ppm (Perl Package Manager) or ppm2 executable to update or install Perl modules for a legacy internal web application (e.g., a custom CGI-based inventory system) that relies on ActiveState’s Perl distribution. The process is often launched from a command prompt or a specific maintenance script.
  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe or powershell.exe and the command line contains arguments like install, update, or list, specifically targeting paths under C:\Perl\bin\ or C:\ActiveState\. Alternatively, whitelist the specific user account (e.g., svc-app-maint) that performs these legacy updates.

• Scheduled Backup or Log Rotation Jobs

  • Scenario: A scheduled task (Task Scheduler) runs a Perl script (e.g., rotate_logs.pl) that uses the ActiveState Perl interpreter to compress, move, or delete old log files for a critical database server. The YARA rule may match the interpreter binary or the script itself if it is loaded from the ActiveState directory.
  • Filter/Exclusion: Exclude detections where the process is spawned by svchost.exe (specifically the Schedule service) or taskschd.msi, and the working directory or command line references known log paths (e.g., C:\Logs\, D:\AppData\Logs\). Whitelist the specific Perl script filename (e.g., rotate_logs.pl) if it is stored in a dedicated maintenance folder.

• Development Environment Testing (IDE Integration)

  • Scenario: A developer using an IDE like Visual Studio Code or IntelliJ IDEA with a Perl extension runs a “Run”