LHARC SFX Archive v113L Hint DOS EP

Hunt Hypothesis

This hypothesis targets the presence of LHARC self-extracting archives, which adversaries frequently use to obfuscate payloads and bypass static analysis by embedding executable code within a compressed container. Proactively hunting for these specific archive signatures in Azure Sentinel allows the SOC to identify potential staging artifacts or initial access tools that may be leveraging legacy or niche compression utilities to evade standard detection mechanisms.

YARA Rule

rule LHARC_SFX_Archive_v113L_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 05 ?? ?? 8E C0 B8 ?? ?? CD 21 BE ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? AC E8 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of self-extracting installers for legacy Java-based enterprise applications (e.g., older versions of SAP GUI, Oracle Client, or IBM WebSphere) that were packaged using LHARC SFX to bundle JAR files and native libraries. These installers often reside in C:\Program Files\ or user temp directories and are executed by deployment scripts.

  • Filter/Exclusion: Exclude files located in known application installation directories (e.g., C:\Program Files\SAP\, C:\Program Files\Oracle\) or exclude execution by known service accounts (e.g., svc_deploy, app_admin) when the parent process is a standard installer service (e.g., msiexec.exe, setup.exe).

• Scenario: Scheduled maintenance jobs that unpack and execute diagnostic or backup utilities for mainframe connectivity tools (e.g., CA-7, IBM Tivoli, or BMC Control-M agents) which use LHARC SFX archives to distribute updated agent binaries or configuration patches during off-hours.

  • Filter/Exclusion: Exclude execution triggered by scheduled tasks with specific names (e.g., *AgentUpdate*, *PatchDeploy*) or exclude processes where the parent is svchost.exe or taskeng.exe and the file path contains keywords like agent, patch, or update in a dedicated software directory.

• Scenario: Deployment of custom internal development tools or build artifacts (e.g., Jenkins pipeline plugins, Ansible roles, or internal CLI utilities) that are distributed as SFX archives to avoid dependency management issues in CI/CD agents or build servers. These are often executed by build service accounts in dedicated build directories.

  • Filter/Exclusion: Exclude files in standard CI/CD workspace directories (e.g., `