Suspiciously packed executable

Hunt Hypothesis

This detection identifies adversaries utilizing packing tools to obfuscate malicious executables and evade signature-based analysis by compressing or encrypting binary content. Proactive hunting for these artifacts in Azure Sentinel is critical because packed binaries often conceal advanced threats that standard antivirus solutions may miss, allowing attackers to establish persistence before triggering broader alerts.

YARA Rule

rule CN_Packed_Scanner {
	meta:
		description = "Suspiciously packed executable"
		author = "Florian Roth"
		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
		score = 40
		date = "06.10.2014"
	strings:
		$s1 = "kernel32.dll" fullword ascii
		$s2 = "CRTDLL.DLL" fullword ascii
		$s3 = "__GetMainArgs" fullword ascii
		$s4 = "WS2_32.DLL" fullword ascii
	condition:
		all of them and filesize < 180KB and filesize > 70KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Automated deployment of Microsoft Office updates via the Office Deployment Tool (ODT) or ClickOnce applications often utilize UPX or custom packers to compress installers before distribution. When these compressed .exe files are executed by the msiexec.exe service account, they trigger the rule due to their high entropy and packed headers.

  • Filter/Exclusion: Create an exclusion for executables located in the C:\Program Files\Microsoft Office\root\Office16\ directory (or specific ClickOnce application paths) where the parent process is msiexec.exe or wuauserv.exe.

• Scenario: System administrators frequently run scheduled maintenance jobs using PowerShell scripts that invoke third-party backup agents (e.g., Veeam, Commvault) or patch management tools (e.g., SCCM/MECM). These tools often distribute packed executables to client machines which are then launched by the Task Scheduler service (svchost.exe with the Schedule group), causing false positives.

  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically the Schedule service group) and the file path contains known vendor directories such as C:\Program Files\Microsoft System Center Configuration Manager\ or C:\Program Files\Veeam\.

• Scenario: Internal DevOps pipelines frequently deploy custom containerized applications or microservices that include packed binaries (often compressed with LZMA or UPX) for initial startup. When these are launched by the CI/CD agent service (e.g., Jenkins Agent, GitHub Actions Runner), the detection logic flags them as suspicious due to the non-standard PE header structure of the packed binary.

  • Filter/Exclusion: Implement a filter allowing execution if the parent process name matches java.exe (for Jenkins) or node.exe