DxPackV086Dxd

Hunt Hypothesis

This detection identifies the execution of a specific software package or artifact matching the “DxPackV086Dxd” signature, which may indicate legitimate application deployment or potential supply chain compromise involving known binaries. Proactive hunting for this indicator in Azure Sentinel is essential to validate its context within the environment and distinguish between expected operational activity and early-stage adversary presence that could be missed by standard alerting thresholds due to its low severity classification.

YARA Rule

rule DxPackV086Dxd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DxPackV086Dxd detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Microsoft Defender Antivirus (MSRT) Scheduled Scans

  • Context: The Microsoft Defender Antivirus service (MsMpEng.exe) frequently executes the “Microsoft Malware Protection Client” scheduled task to perform real-time or on-demand scans. During these scans, it often unpacks and analyzes diagnostic packages that match the DxPackV086Dxd signature pattern, triggering a false alert when no malicious activity is present.
  • Filter/Exclusion: Exclude processes where the parent process name is MsMpEng.exe or the command line contains arguments related to ScanType=OnDemand. Additionally, add an exclusion for the specific file path: C:\Program Files\Windows Defender\MpCmdRun.exe when executed by the SYSTEM account.

• Scenario: SCCM (Configuration Manager) Application Deployment

  • Context: System Center Configuration Manager (SCCM) often deploys diagnostic tools or application patches to endpoints using the ccmsetup.exe or wuauserv services. When deploying a specific diagnostic package, the installer extracts temporary files that trigger the YARA rule due to matching header structures in the payload.
  • Filter/Exclusion: Create an exclusion based on the process image path containing \Microsoft\CCM\ and filter alerts where the user context is NT AUTHORITY\SYSTEM. Specifically, exclude events where the parent process is ccmexec.exe or wuauserv.exe during standard maintenance windows (e.g., 02:00 – 06:00).

• Scenario: Endpoint Detection and Response (EDR) Telemetry Collection

  • **Context