Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)

Hunt Hypothesis

This detection identifies compact executables that import a high density of suspicious functions, characteristic of early-stage fileless malware or custom loaders designed to evade signature-based defenses. Proactively hunting for these artifacts in Azure Sentinel is critical because their small footprint often allows them to bypass traditional antivirus solutions while establishing a foothold for subsequent lateral movement or data exfiltration campaigns.

YARA Rule

rule Tiny_Network_Tool_Generic {
	meta:
		description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
		author = "Florian Roth"
		date = "08.10.2014"
		score = 40
		type = "file"
		hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
		hash1 = "cafc31d39c1e4721af3ba519759884b9"
		hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
	strings:
		$magic	= { 4d 5a }

		$s0 = "KERNEL32.DLL" fullword ascii
		$s1 = "CRTDLL.DLL" fullword ascii
		$s3 = "LoadLibraryA" fullword ascii
		$s4 = "GetProcAddress" fullword ascii

		$y1 = "WININET.DLL" fullword ascii
		$y2 = "atoi" fullword ascii

		$x1 = "ADVAPI32.DLL" fullword ascii
		$x2 = "USER32.DLL" fullword ascii
		$x3 = "wsock32.dll" fullword ascii
		$x4 = "FreeSid" fullword ascii
		$x5 = "atoi" fullword ascii

		$z1 = "ADVAPI32.DLL" fullword ascii
		$z2 = "USER32.DLL" fullword ascii
		$z3 = "FreeSid" fullword ascii
		$z4 = "ToAscii" fullword ascii

	condition:
		( $magic at 0 ) and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*) ) and filesize < 15KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “Tiny Tool with Suspicious Function Imports”

• Scenario: Legitimate PowerShell Script Execution via Scheduled Task

  • Context: An automated maintenance script (e.g., CleanTemp.ps1) runs nightly via Windows Task Scheduler. The script is a small, compiled executable or script host that imports standard .NET functions like System.IO.FileInfo and System.Management.Automation to clean logs, which the rule flags as “suspicious” due to the tool’s small footprint combined with multiple function imports.
  • Filter/Exclusion: Exclude processes where the parent process is TaskScheduler.exe (or svchost.exe running the scheduler service) and the file path resides in a known administrative directory, such as C:\ProgramData\Company\Maintenance\Scripts\.

• Scenario: Deployment of Lightweight Monitoring Agents

  • Context: A lightweight monitoring agent (e.g., Datadog Agent, New Relic One Agent, or SolarWinds SAM) is installed on a server. These agents often run as small executables that dynamically load various .NET assemblies to collect system metrics, triggering the rule due to the “tiny tool” size and high volume of function imports during initialization.
  • Filter/Exclusion: Create an exclusion for specific known agent binaries (e.g., dd_agent.exe, nragent.exe) located in their standard installation paths (C:\Program Files\Datadog\ or C:\Program Files\New Relic\).

• Scenario: Execution of Microsoft Office Click-to-Run Updater

  • Context: The Microsoft Office Click-to-Run Service (OfficeClickToRun.exe) runs periodically to check for updates. This service is a small utility that imports several COM and .NET functions to manage the installation state, often mimicking