← Back to SOC feed Coverage →

Elex Service 32 bits

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-14T11:00:00Z · Confidence: medium

Hunt Hypothesis

The Elex Service 32 bits detection rule identifies potential adversary activity involving the execution of a 32-bit service that may be used for persistence or lateral movement. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate potential compromise of systems running 32-bit services in a 64-bit environment.

YARA Rule

rule Trj_Elex_Service32 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex Service 32 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = "http://xa.xingcloud.com/v4/sof-everything/"
        $str2 = "http://www.mysearch123.com"
        $str3 = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma"
        
    condition:
        (pe.machine == pe.MACHINE_I386) and ($mz at 0) and ($str1) and ($str2) and ($str3)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_Elex.yar