tElock v098 tE

Hunt Hypothesis

This hypothesis targets the presence of the tElock v098 tE YARA signature, which indicates the execution or persistence of a specific low-severity threat actor or tooling variant within the environment. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify early-stage footholds or dormant payloads that may have evaded standard behavioral detections, ensuring timely remediation before the adversary escalates privileges or exfiltrates data.

YARA Rule

rule tElock_v098_tE: PEiD
{
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy

  • Scenario: An enterprise IT team deploys a legacy line-of-business application (e.g., a specific version of SAP GUI or an older Java-based tool) that was compiled with an older version of the tElock protection wrapper. The binary is pushed to endpoints via Group Policy Software Installation or SCCM, triggering the YARA rule on the file system.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\LegacyApp\) or specific known-good hashes associated with the deployed legacy application version.

• Scheduled Backup or Archiving Job

  • Scenario: A nightly scheduled task (e.g., BackupAgent.exe or a custom PowerShell script) processes and moves log files or database dumps that were previously compressed or protected using tElock utilities. The rule triggers when the agent reads or writes these protected files during the backup window.
  • Filter/Exclusion: Exclude processes running from the backup service directory (e.g., C:\Program Files\BackupService\) or exclude file paths matching the backup repository location (e.g., \\fileserver\backups\) during the defined backup time window.

• Developer Testing in Isolated Environments

  • Scenario: A software development team uses tElock to protect test binaries or configuration files in a dedicated development VM or container. The YARA rule scans these test artifacts during a routine integrity check or CI/CD pipeline validation step, causing a false positive.
  • Filter/Exclusion: Exclude files within the development workspace directory (e.g., C:\Dev\Projects\) or exclude the specific user account associated with the development team (e.g., DOMAIN\dev-team) when the file path matches the test environment structure.