← Back to SOC feed Coverage →

PKTINYv10withTINYPROGv38

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-20T23:00:00Z · Confidence: medium

Hunt Hypothesis

This rule detects the presence of the TINYPROGv38 payload, a known component of the TINYPROG malware family, which adversaries deploy to establish persistence or execute malicious logic within Azure environments. Proactively hunting for this signature allows the SOC team to identify low-severity, stealthy implantations that may serve as initial footholds for lateral movement or data exfiltration before they escalate to higher-impact activities.

YARA Rule

rule PKTINYv10withTINYPROGv38
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E C6 06 [3] 2E C6 06 [3] 2E C6 06 [3] E9 [2] E8 [2] 83 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar