tElock096tE

Hunt Hypothesis

This YARA rule detects the presence of the tElock096tE malware signature, which typically indicates a low-severity threat or specific payload execution on host systems. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints early, ensuring rapid containment before the low-severity threat escalates or establishes persistence.

YARA Rule

rule tElock096tE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 59 E4 FF FF 00 00 00 00 00 00 00 [4] EE [2] 00 00 00 00 00 00 00 00 00 0E [2] 00 FE [2] 00 F6 [2] 00 00 00 00 00 00 00 00 00 1B [2] 00 06 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 [2] 00 00 00 00 00 39 [2] 00 00 00 00 00 26 [2] 00 00 00 00 00 39 [2] 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Java application server (e.g., Tomcat or WildFly) is deployed with a custom build that includes the tElock096tE signature in its native library or bootstrap JAR file, which is loaded during the standard service startup process.
  • Filter/Exclusion: Exclude processes where the parent process is java.exe or jre.exe and the loaded module path resides within the application’s specific lib/ or bin/ directory, provided the file hash matches the known good baseline for that application version.
• Scenario: An IT administrator manually extracts a diagnostic tool or patch installer (e.g., from a vendor’s support portal) to a temporary folder (C:\Temp or %USERPROFILE%\Downloads) to troubleshoot a specific service, and the YARA rule scans the extracted binary before it is executed or moved to the standard install directory.
  • Filter/Exclusion: Exclude files located in common temporary or download directories (C:\Temp, C:\Users\<user>\Downloads, %TEMP%) if the file age is less than 24 hours and the parent process is an explorer or file manager (explorer.exe, cmd.exe, powershell.exe) rather than a service host.
• Scenario: A CI/CD pipeline agent (e.g., Jenkins, GitLab Runner, or Azure DevOps Agent) downloads a build artifact or dependency package that contains the tElock096tE signature as part of a legitimate third-party library or obfuscated code segment, which is then unpacked and executed in the build workspace.
  • Filter/Exclusion: Exclude processes running under the CI/CD service account (e.g., jenkins-agent, gitlab-runner) where the working directory matches the defined build workspace path (e.g., `/var/lib/j