This YARA rule targets specific memory or file patterns associated with the Pohernah101byKas signature, potentially indicating the presence of a low-severity web shell, backdoor, or obfuscated script used for initial access or persistence. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify dormant or stealthy footholds in web servers or storage accounts before they are leveraged for lateral movement or data exfiltration.
rule Pohernah101byKas
{
meta:
author="malware-lu"
strings:
$a0 = { 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer uses a custom Python script or PowerShell wrapper to automate the deployment of a new microservice, where the script explicitly calls os.rename() or Move-Item to swap out a versioned binary (e.g., app_v1.0.exe to app_v1.1.exe) in a temporary build directory before copying it to the production path.
python.exe, pwsh.exe, or node.exe and the file path contains standard build directories like \build\, \dist\, or \tmp\.Scenario: An IT administrator performs a manual patching task using a third-party installer (e.g., 7z.exe or Inno Setup) that extracts files to a temporary folder and then moves the final executable to the target installation directory (e.g., C:\Program Files\App\) as part of the standard installation workflow.
\Temp\ or \tmp\ and the destination is within a standard program installation directory (C:\Program Files\ or C:\Program Files (x86)\).Scenario: A scheduled maintenance job (e.g., a SQL Server maintenance plan or a custom log rotation script) runs via Task Scheduler to archive old log files by moving them from an active logs folder to an archive folder (e.g., C:\Logs\active\ to C:\Logs\archive\), which may involve renaming or moving large files.
svchost.exe (specifically the Task Scheduler service) or cmd.exe/powershell.exe triggered by a known scheduled task ID, and the file extension is