PseudoSigner 01 ACProtect 109

Hunt Hypothesis

This rule identifies potentially malicious or obfuscated executables protected by ACProtect, a tool frequently used by adversaries to evade signature-based detection and hide code logic. Proactively hunting for these artifacts in Azure Sentinel helps surface low-severity threats that may indicate early-stage reconnaissance or the deployment of custom malware designed to bypass standard endpoint defenses.

YARA Rule

rule PseudoSigner_01_ACProtect_109: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
        $b = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy internal application or utility (e.g., a custom .NET or C++ tool) is compiled using the ACProtect 109 packer for obfuscation or lightweight protection, and the binary is deployed to user workstations or servers via Group Policy Software Installation or SCCM.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalTools\LegacyApp\) or exclude binaries where the Product or FileDescription metadata matches known internal tool names.
• Scenario: A third-party vendor plugin or SDK (e.g., a specific video codec, audio driver, or database connector) is packaged with ACProtect 109 to protect intellectual property, and it is installed in a standard vendor folder during routine patching or software updates.
  • Filter/Exclusion: Exclude files within known vendor directories (e.g., C:\Program Files\VendorName\Plugin\) or exclude specific file hashes (SHA-256) of the known good vendor binaries.
• Scenario: A scheduled maintenance job or script runner (e.g., a PowerShell wrapper or a small C# executable) used for log rotation or data cleanup is packed with ACProtect 109 to prevent tampering, and it resides in a system service directory or a dedicated scripts folder.
  • Filter/Exclusion: Exclude files located in C:\Windows\System32\ (if running as a system service) or specific script directories (e.g., C:\Scripts\Maintenance\), and verify the parent process is a known service host (e.g., svchost.exe, powershell.exe).
• Scenario: A developer or IT admin tests a new internal build on a jump server or build agent, where the binary is packed with ACProtect 109 for