RECSmall v101 Hint DOS EP

Hunt Hypothesis

This YARA rule identifies the RECSmall v101 packer, a tool frequently used by threat actors to compress executables and obscure their entry points to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to detect potentially packed malware or trojans that may be leveraging this specific packing technique to hide malicious payloads within the environment.

YARA Rule

rule RECSmall_v101_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C D8 1E E8 ?? ?? 5D 83 ?? ?? 81 ?? ?? ?? B9 ?? ?? 40 8E D8 2B DB B2 55 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Utility Execution via Scheduled Task

  • Scenario: An IT operations team deploys a legacy 16-bit or early 32-bit utility (e.g., Sysinternals tools like PsExec or older versions of WinRAR/7-Zip console binaries) that has a DOS header hint and a small entry point. This is often executed via a Windows Scheduled Task for maintenance windows (e.g., disk cleanup or log rotation).
  • Filter/Exclusion: Exclude processes where the parent process is schtasks.exe or Task Scheduler service, and the executable path resides in standard administrative directories (e.g., C:\Program Files\Tools\, C:\Admin\Utils\).

• Development Environment Build Artifacts

  • Scenario: A developer or CI/CD pipeline compiles a small C/C++ application or a Python script wrapped with py2exe/cx_Freeze that results in a small executable with a DOS stub. These binaries are frequently executed during local testing or automated build verification steps on developer workstations.
  • Filter/Exclusion: Exclude executions originating from known development directories (e.g., C:\Users\<user>\Projects\, C:\dev\, C:\ci\builds\) or where the parent process is a known IDE/build tool (e.g., cmd.exe launched by Visual Studio Code, Jenkins agent, or Git Bash).

• Antivirus/EDR Self-Test or Quarantine Extraction

  • Scenario: Security tools (e.g., CrowdStrike, Defender, or ESET) perform self-integrity checks or extract quarantined files to a temporary directory for analysis. The extracted file may be a small, legacy binary that triggers the YARA rule due to its DOS header and