Trap 118 EXE

Hunt Hypothesis

This rule identifies executable files matching the YARA signature for Trap 118, which may indicate the presence of a specific malware family or suspicious binary artifact within the environment. Proactively hunting for this signature allows the SOC team to detect low-severity indicators of compromise early, ensuring that potentially benign-looking executables are investigated before they can be leveraged for lateral movement or persistence.

YARA Rule

rule Trap_118_EXE: PEiD
{
    strings:
        $a = { 8C D0 BB 99 CB 8E D3 33 C9 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Trap_118.exe payload by the CrowdStrike Falcon Sensor during a routine integrity check or update cycle. The sensor often drops temporary executable artifacts in C:\ProgramData\CrowdStrike or C:\Windows\Temp that match the YARA signature for Trap 118 due to shared code patterns or specific import tables.

  • Filter/Exclusion: Exclude paths containing C:\ProgramData\CrowdStrike\ or C:\Windows\Temp\ where the parent process is FalconSensor.exe or FalconService.exe.

• Scenario: A legitimate Microsoft Defender for Endpoint remediation task executes a custom script or helper executable named Trap_118.exe (or a similarly named artifact) within the C:\Program Files\Microsoft Defender directory to clean up infected files. This is common in automated response playbooks triggered by high-severity detections.

  • Filter/Exclusion: Exclude if the executable path matches C:\Program Files\Microsoft Defender\ and the parent process is MsMpEng.exe or SecurityHealthSystray.exe.

• Scenario: An enterprise Patching Tool (e.g., WSUS or SCCM/MECM) deploys a specific driver or utility package that includes a binary named Trap_118.exe as part of a vendor-specific update (e.g., a BIOS update or firmware tool from Dell/HPE). These tools often run from C:\Windows\Temp or C:\Users\Public\ with elevated privileges.

  • Filter/Exclusion: Exclude if the parent process is WuaExe.exe, ccmexec.exe, or Taskengw.exe and the file path contains C:\Windows\Temp\ or