PseudoSigner 01 ACProtect 109 additional

Hunt Hypothesis

This hypothesis targets the presence of ACProtect-packed binaries, a common obfuscation technique used by adversaries to hide malicious payloads and evade signature-based detection. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify potentially compromised endpoints or suspicious artifacts that may be leveraging packing to mask their true intent before they execute further malicious actions.

YARA Rule

rule PseudoSigner_01_ACProtect_109_additional: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of ACProtect.exe or ACProtectGUI.exe during manual application hardening tasks by the DevOps or Security Engineering team.
  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe, powershell.exe, or pwsh.exe and the command line contains arguments like /s, /p, or /o (indicating specific protection operations), or exclude based on the specific file path C:\Tools\ACProtect\bin\ACProtect.exe.
• Scenario: Automated build pipelines (e.g., Jenkins, Azure DevOps, or GitHub Actions) invoking ACProtect as part of a post-compilation step to obfuscate release binaries before deployment to staging environments.
  • Filter/Exclusion: Exclude processes where the parent process is java.exe (Jenkins agent), node.exe (CI runner), or dotnet.exe (build tool), and the working directory matches known CI/CD workspace paths such as C:\Jenkins\workspace\ or D:\AzureDevOps\agent\.
• Scenario: Scheduled maintenance jobs or service accounts running ACProtect in “headless” or batch mode to re-protect legacy applications during off-hours maintenance windows.
  • Filter/Exclusion: Exclude processes where the parent process is schtasks.exe or taskeng.exe (Task Scheduler engine), and the user context is a known service account (e.g., DOMAIN\svc-maintenance or DOMAIN\svc-build).
• Scenario: Third-party installer packages or vendor-provided setup utilities that bundle ACProtect to protect their own components during installation, often executed from temporary directories.
  • Filter/Exclusion: Exclude processes where the file path contains \Temp\, \tmp\, or \Setup\ and the parent process is `