← Back to SOC feed Coverage →

Thinstall24x25xJititSoftware

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-31T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of potentially malicious or unauthorized JIT (Just-In-Time) software installations that may indicate an adversary attempting to establish persistence through legitimate system tools. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy initial access attempts where attackers leverage trusted installation mechanisms to evade standard signature-based defenses.

YARA Rule

rule Thinstall24x25xJititSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D [4] B9 [4] BA [4] BE [4] BF [4] BD [4] 03 E8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Thinstall24x25xJititSoftware detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar