← Back to SOC feed Coverage →

Elex Service 64 bits

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-14T11:00:00Z · Confidence: medium

Hunt Hypothesis

The Elex Service 64 bits detection rule identifies potential adversary activity involving the execution of a suspicious 64-bit service, which may indicate the deployment of malicious software or persistence mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced threats that leverage service execution as part of their attack lifecycle.

YARA Rule

rule Trj_Elex_Service64 
{
    
    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex Service 64 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = "http://xa.xingcloud.com/v4/sof-everything/"
        $str2 = "http://www.mysearch123.com"
        $str3 = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma"
        
    condition:
        (pe.machine == pe.MACHINE_AMD64) and ($mz at 0) and ($str1) and ($str2) and ($str3)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_Elex.yar