PolyCrypt PE 214b215 JLab Software Creations h signed additional

Hunt Hypothesis

This rule identifies the presence of the PolyCrypt ransomware variant, specifically targeting files associated with JLab Software Creations, indicating an adversary is actively encrypting data to disrupt operations. Proactively hunting for this signature in Azure Sentinel allows the SOC team to detect early-stage encryption activity on endpoints or storage accounts before the ransomware can fully propagate and lock critical business data.

YARA Rule

rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_signed_additional: PEiD
{
    strings:
        $a = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin uses JLab’s PolyCrypt (a known open-source encryption tool) to encrypt sensitive configuration files or backup archives on a workstation or build server. The binary is digitally signed by “JLab Software Creations,” matching the rule’s signature, and resides in a standard application directory like C:\Program Files\JLab\.

  • Filter/Exclusion: Exclude files located in C:\Program Files\JLab\ or C:\Program Files (x86)\JLab\ if the parent process is a known installer or the file hash matches a known good baseline. Alternatively, exclude if the file extension is .exe and the path contains \JLab\.

• Scenario: An automated scheduled task or CI/CD pipeline (e.g., Jenkins, Azure DevOps) runs a script that invokes the PolyCrypt executable to encrypt artifacts before uploading them to a secure storage bucket. The executable is temporarily extracted to a temporary directory (e.g., C:\Temp\ or C:\Users\<user>\AppData\Local\Temp\) by the build agent.

  • Filter/Exclusion: Exclude if the file path contains \Temp\ or \AppData\Local\Temp\ AND the parent process is a known build agent (e.g., java.exe, node.exe, powershell.exe with a specific command line containing build or pipeline).

• Scenario: A third-party backup or encryption utility (e.g., Veeam, Acronis, or a custom internal tool) bundles the PolyCrypt engine as a dependency. The signed binary is loaded into memory or executed from a non-standard location like C:\ProgramData\<BackupTool>\bin\ during a nightly backup job.

  • Filter/Exclusion: Exclude