← Back to SOC feed Coverage →

Elex DLL 64 bits

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-14T11:00:00Z · Confidence: medium

Hunt Hypothesis

The Elex DLL 64 bits detection rule identifies potential adversary use of a malicious DLL file in a 64-bit environment, which may indicate lateral movement or persistence. SOC teams should proactively hunt for this behavior to detect and mitigate advanced threats that leverage DLL side-loading techniques in Azure Sentinel.

YARA Rule

rule Trj_Elex_Dll64 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex DLL 64 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = {59 00 72 00 72 00 65 00 68 00 73 00}
        $str2 = "RookIE/1.0"
        
    condition:
        (pe.machine == pe.MACHINE_AMD64) and (pe.characteristics & pe.DLL) and ($mz at 0) and ($str1) and ($str2)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_Elex.yar