aPack 098 i m COM

Hunt Hypothesis

This rule detects the presence of the “i m COM” component, a known artifact associated with the aPack malware family, which often leverages COM objects for execution or persistence. Proactively hunting for this specific YARA signature allows the SOC to identify early-stage infections or dormant payloads that may have evaded standard behavioral detections, ensuring rapid containment before lateral movement occurs.

YARA Rule

rule aPack_098_i_m_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 AC F6 D0 AA FF D5 73 F8 FF D5 41 73 12 FF D5 BB 10 00 72 24 FF D5 12 DB 73 FA 75 00 93 EB 00 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Microsoft Defender for Endpoint (MDE) Agent Updates: The MDE agent (MsMpEng.exe or related service processes) often performs in-memory code execution or loads COM objects during definition updates or health checks.
  • Filter/Exclusion: Exclude processes where the parent is MsMpEng.exe or SecurityHealthService.exe, and the image path resides in C:\Program Files\Microsoft Security Client\ or C:\Program Files\Windows Defender\.
• Windows Update Service (WaaS) and Component Cleanup: The TiWorker.exe (Windows Update Orchestrator Service) or svchost.exe (k) frequently instantiate COM objects to manage package installations, driver updates, or component cleanup tasks.
  • Filter/Exclusion: Exclude if the parent process is TiWorker.exe or svchost.exe (specifically the k service host) and the working directory is C:\Windows\SoftwareDistribution\ or C:\Windows\Temp\.
• PowerShell Script Execution via COM Objects: Legitimate administrative scripts (e.g., Get-ADUser, Set-ItemProperty on WMI/COM interfaces) executed by powershell.exe or pwsh.exe will trigger COM instantiation. This is common in onboarding/offboarding automation or GPO application.
  • Filter/Exclusion: Exclude if the parent process is powershell.exe or pwsh.exe and the script path is in a known admin folder (e.g., C:\Admin\Scripts\, C:\Corp\Automation\), or if the command line contains standard cmdlets like Get-, Set-, New-, or Invoke-.
• Visual Studio Code (VS Code) or JetBrains IDE Extensions: Development environments like VS Code (`Code