Adversaries often use high-entropy strings or data to obfuscate malicious payloads, such as encoded shellcode or encrypted configuration files, to evade static analysis and signature-based detection. Proactively hunting for these anomalies in Azure Sentinel allows the SOC team to identify suspicious artifacts that deviate from normal baseline patterns, potentially uncovering stealthy implants or data exfiltration attempts before they are fully executed.
rule IsPacked : PECheck
{
meta:
description = "Entropy Check"
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550 and
math.entropy(0, filesize) >= 7.0
}This YARA rule can be deployed in the following contexts:
cipher or compress which inherently manipulate file structures and can temporarily alter perceived entropy metrics during disk I/O operations.
cipher.exe, compress.exe, or expand.exe, or filter out events where the file extension is .zip, .rar, or .7z during the operation.wuaexhost.exe or ccmexec.exe writes compressed or encrypted payloads to disk, causing transient entropy spikes in the target directory.
wuaexhost.exe, ccmexec.exe, or svchost.exe (specifically for the Windows Update service), or filter based on the source path containing \Windows\Installer\ or \SCCM\..vbk, .bkd) to network shares or local disks, resulting in high-entropy file signatures.
.vbk, .bkd, .bak, .vib) or filter events where the destination path contains keywords like \Backup\, \Veeam\, or \Commvault\..pack files) within .git or .hg directories, which naturally exhibit high entropy due to compression and delta encoding.
.pack or .idx located