Rescator PDB strings within binaries

Hunt Hypothesis

This detection identifies the presence of Rescator Public Database (PDB) signature strings within executable binaries, which may indicate the use of legitimate software or potential code signing artifacts often overlooked in standard scans. Proactively hunting for these specific strings in Azure Sentinel allows the SOC team to establish a baseline of known good binary characteristics and rapidly distinguish between expected application behavior and anomalous file modifications that could signal early-stage supply chain compromises.

YARA Rule

rule pdb_strings_Rescator
{
meta:
	author = "@patrickrolsen"
	maltype = "Target Attack"
	version = "0.3"
	description = "Rescator PDB strings within binaries"
	date = "01/30/2014"
strings:
	$pdb1 = "\\Projects\\Rescator" nocase
condition:
	uint16(0) == 0x5A4D and $pdb1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Rescator PDB strings within binaries detection rule, along with suggested filters or exclusions:

• Scenario: Deployment of Rescator-Integrated Applications via SCCM/Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune deploys enterprise applications (e.g., a custom internal CRM built on the .NET framework using Rescator libraries). The deployment agent extracts binaries that inherently contain “Rescator” PDB strings as part of their standard build artifacts.
  • Suggested Filter: Exclude processes where ParentProcessName is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the file path contains \SoftwareDistribution\ or \Microsoft Intune Management Extension\.

• Scenario: Automated Backup Job Execution by Veeam Backup & Replication

  • Context: The nightly backup job runs the VeeamAgent.exe service, which utilizes Rescator components for data deduplication and integrity checking. When the agent scans or restores large binary datasets, it generates temporary files or logs containing these specific PDB signatures, triggering the rule despite being a known administrative function.
  • Suggested Filter: Create an exclusion for ProcessName equal to VeeamAgent.exe or vbrservice.exe, specifically when the CommandLine contains arguments related to backup jobs (e.g., -JobID or -Restore).

• Scenario: Software Updates via Chocolatey Package Manager

  • Context: The IT team uses Chocolatey (choco.exe) to push updates for development tools like Visual Studio or specific SDKs that rely on Rescator libraries. During the installation phase, the installer extracts binaries with embedded PDB strings into the `C:\Program Files\