Auto-generated rule - file pth.dll

Hunt Hypothesis

This detection targets adversaries leveraging Process Hollowing to inject malicious payloads into legitimate processes via the pth.dll library, a common technique for evading signature-based defenses in Windows environments. Proactive hunting is essential within Azure Sentinel to identify early-stage lateral movement and privilege escalation attempts that may bypass standard alert thresholds before establishing persistent command-and-control channels.

YARA Rule

rule whosthere_alt_pth : Toolkit  {
	meta:
		description = "Auto-generated rule - file pth.dll"
		author = "Florian Roth"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
	strings:
		$s0 = "c:\\debug.txt" fullword ascii /* PEStudio Blacklist: strings */ /* score: '23.00' */
		$s1 = "pth.dll" fullword ascii /* score: '20.00' */
		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii /* score: '7.00' */
		$s3 = "\"Primary\" string not found!" fullword ascii /* score: '6.00' */
		$s4 = "segment 1 found at %.8Xh" fullword ascii /* score: '6.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 240KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the pth.dll detection rule in an enterprise environment, including suggested filters and exclusions:

• Microsoft Endpoint Configuration Manager (MECM/SCCM) Software Updates

  • Scenario: The SCCM Client Agent (ccmexec.exe) frequently loads pth.dll during scheduled software deployment cycles or patch installation tasks. This often occurs when the agent is preparing a new session for a user or installing updates that require privilege escalation, triggering the file creation or loading event without malicious intent.
  • Suggested Filter: Exclude events where the parent process name is ccmexec.exe and the command line contains arguments related to “SoftwareUpdates” or “DeploymentManager”.

• Microsoft Defender Antivirus Real-Time Scanning

  • Scenario: The Microsoft Defender Antivirus service (MsMpEng.exe) utilizes pth.dll as part of its engine for real-time protection, specifically when scanning user directories or handling file integrity checks. This is a standard behavior during peak business hours or after a definition update cycle.
  • Suggested Filter: Create an exclusion rule for the parent process MsMpEng.exe running under the NT SERVICE\Antimalware account, provided the file path of pth.dll resides within the %ProgramFiles%\Windows Defender\ directory structure.

• Group Policy Object (GPO) Application via gpupdate

  • Scenario: During scheduled Group Policy refresh cycles (typically every 90 minutes or at user logon), the gpsvc.exe service loads pth.dll to apply security policies, drive mappings, and software installation settings. This is a routine administrative task that generates significant file system activity.
  • Suggested Filter: Exclude events where the parent process is gpupdate.exe or svchost.exe (specific