This rule identifies the presence of the SkDUndetectabler YARA signature, which typically indicates the use of a specific malware family or tooling designed to evade standard detection mechanisms. Proactively hunting for this indicator allows the SOC team to uncover low-severity but potentially persistent threats that may be operating below the noise threshold of high-severity alerts in the Azure Sentinel environment.
rule SkDUndetectabler : SkDrat {
meta:
author = "_pusher_"
condition:
(
borland_delphi or //check All FSG or
((pe.linker_version.major == 6) and (pe.linker_version.minor == 0 ))
)
and
(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size < filesize) and
//is overlay at offset 2A00,1A00,C00,745,739
//pe.overlay & pe.overlay_size would have been prettier
(
(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000739) or
(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000745) or
//Uncompressed
(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000C00) or
(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00002A00) or
(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00001A00)
)
and
//is xored MZ ?
(
uint16(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x6275 or
uint16(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x4057
)
}This YARA rule can be deployed in the following contexts:
Scenario: A developer or DevOps engineer uses a legitimate binary obfuscation tool (such as UPX or ASPack) to compress or pack a custom internal utility or plugin to reduce its file size before deployment. The packing process alters the binary’s header and structure in a way that matches the heuristic patterns defined in the SkDUndetectabler YARA rule.
C:\Builds\Artifacts\) or add an exclusion for binaries with known digital signatures from the internal code-signing certificate authority.Scenario: An IT administrator deploys a custom PowerShell script wrapped in a .NET executable using PS2EXE or PowerShell2Exe to create a standalone installer for a new internal application. The resulting executable contains embedded script logic and standard .NET runtime structures that may inadvertently match the “undetectable” or hidden component patterns of the rule.
.exe extension that are located in the C:\Program Files\InternalApps\ directory and have a valid timestamp within the last 30 days, or specifically exclude binaries generated by the PS2EXE tool by checking for specific metadata strings in the binary header.Scenario: A security team performs a red team exercise or internal penetration test, using a legitimate open-source tool like Cobalt Strike or Beacon (in its standard, non-customized form) to simulate an attacker. The standard build of these tools often contains known signatures or structural patterns that trigger generic YARA rules designed to catch “undetectable” or stealthy implants.
beacon.exe, `cobalt