ACProtectv141

Hunt Hypothesis

This rule identifies the presence of ACProtect v14.1, a commercial software packer often used by adversaries to compress and obfuscate executables to evade static analysis and signature-based detection. Proactive hunting for this specific packer version in Azure Sentinel allows the SOC to uncover potentially hidden or newly deployed binaries that may be leveraging packing techniques to conceal malicious payloads within the environment.

YARA Rule

rule ACProtectv141
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of acprotect.exe or acunpack.exe by a software vendor’s support engineer during a remote session to unpack a protected installer (e.g., for legacy accounting software like Sage or QuickBooks) to inspect embedded payloads or fix a corrupted installation.
  • Filter/Exclusion: Exclude processes where the parent process is a remote desktop client (e.g., mstsc.exe, rdpclip.exe, teamviewer.exe, anydesk.exe) or where the command line contains arguments like /unpack, /extract, or /v (verbose).
• Scenario: A scheduled maintenance job runs a custom PowerShell script or batch file that invokes an ACProtect-packed utility (e.g., license_check.exe) to validate software licenses or update configuration files for third-party middleware (e.g., Apache Tomcat, Nginx, or IIS components) during off-peak hours.
  • Filter/Exclusion: Exclude executions where the parent process is cmd.exe, powershell.exe, or pwsh.exe and the working directory is a known application folder (e.g., C:\Program Files\VendorApp\bin, C:\AppData\Local\VendorTool).
• Scenario: An endpoint detection and response (EDR) agent or anti-malware tool (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a real-time scan or on-demand scan of a large directory containing many ACProtect-packed executables (common in game launchers, Adobe Creative Cloud, or Java-based applications), causing the YARA rule to match multiple files simultaneously.
  • Filter/Exclusion: Exclude processes where the parent process is an EDR/AV service executable (e.g., FalconSensor.exe, MsMpEng.exe, SentinelOne.exe) or where the process name matches