Reg2Exe225byJanVorel

Hunt Hypothesis

This rule detects the presence of a specific executable file signature associated with the “Reg2Exe” tool, which adversaries may use to convert registry entries into executable payloads for persistence or privilege escalation. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify potentially compromised endpoints where this low-severity but functionally significant tool has been deployed, enabling early intervention before it is leveraged in a larger attack chain.

YARA Rule

rule Reg2Exe225byJanVorel
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin uses a portable version of 7-Zip or WinRAR to extract a large software bundle (e.g., .7z or .rar) containing executable files directly into a user’s Downloads or Desktop folder. The YARA rule likely matches the specific byte pattern of the archive header or the embedded PE structure of the extracted executables, triggering a “Reg2Exe” (Registry to Executable or similar heuristic) alert.

  • Filter/Exclusion: Exclude alerts where the parent process is 7z.exe, WinRAR.exe, or tar.exe AND the file path contains \Downloads\ or \Desktop\ AND the file extension is one of the common archive types (.7z, .rar, .zip, .tar).

• Scenario: An enterprise Java application (e.g., a custom internal tool) uses java -jar to launch a JAR file that contains native .dll or .exe resources, or the JVM itself creates temporary executable stubs in the %TEMP% directory during class loading or native library extraction. The rule may misinterpret the JVM’s temporary file creation or the specific memory layout of the Java process as a suspicious registry-to-exe transition.

  • Filter/Exclusion: Exclude alerts where the parent process is java.exe or javaw.exe AND the file path contains \jre\ or \jdk\ or \temp\ AND the file name ends with .jar, .dll, or .so.

• Scenario: A PowerShell script executed by a scheduled task (e.g., a nightly backup or log rotation job) uses Start-Process or Invoke-Expression to launch a standard utility like certutil.exe or bitsadmin.exe to download or verify a file,