WinDefAVEmu_goatfiles

Created the Monday 19 August 2024. Updated 2 months, 4 weeks ago.

Goat files inside Defender AV Emulator's file system. Often used in PE malware as an evasion technique to evade executing in Windows Defender's AV Emulator.

Technique Identifier

U1348

Detection Rules

rule YARA_Detect_WindowsDefender_AVEmulator
{
    meta:
        description = "Goat files inside Defender AV Emulator's file system. Often used in PE malware as an evasion technique to evade executing in Windows Defender's AV Emulator."
        author = "@albertzsigovits"
        date = "2024-07-10"
        reference = "https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Alexei-Bulazel-Reverse-Engineering-Windows-Defender-Updated.pdf"
        sha256 = "eb80da614515ff14b3fc312bef38b0d765ce3f4356db5b7b301a3b7c47f7c311"

    strings:
        $ = "\\INTERNAL\\__empty" ascii wide
        $ = "myapp.exe" ascii wide
        $ = "aaa_TouchMeNot_.txt" ascii wide
    condition:
        uint16(0) == 0x5A4D
        and uint32(uint32(0x3C)) == 0x00004550
        and 2 of them
}

Contributors

albertzsigovits

WinDefAVEmu_goatfiles

Technique Identifier

Detection Rules

Contributors

Subscribe to our Newsletter