LocklessIntroPack

Hunt Hypothesis

This detection identifies the presence of the LocklessIntroPack library within executable files, which often serves as a precursor to memory-only malware or fileless attack techniques that bypass traditional signature-based defenses. Proactive hunting for this indicator in Azure Sentinel is essential to uncover stealthy adversary activities that may evade standard antivirus solutions by operating entirely in memory without leaving persistent artifacts on disk.

YARA Rule

rule LocklessIntroPack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 [4] 5D 8B C5 81 ED F6 73 [2] 2B 85 [4] 83 E8 06 89 85 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the LocklessIntroPack detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Installation Updates

  • Context: The Office Click-to-Run service (OfficeClickToRun.exe) frequently downloads and unpacks update payloads into temporary directories without utilizing the standard Windows “lockless” extraction method expected by the rule, triggering a match during routine patching cycles.
  • Filter/Exclusion: Exclude processes where ProcessName equals OfficeClickToRun.exe AND ProcessPath starts with C:\Program Files\Microsoft Office Root\Office16\.

• Scenario: Antivirus Quarantine and Cleanup Jobs

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, often extract suspicious archives to a quarantine folder. The extraction engine used by these tools may mimic the “lockless” signature of the rule while processing large zip packages containing malware samples.
  • Filter/Exclusion: Create an exclusion for any process running under C:\ProgramData\Microsoft\Windows Defender\ or C:\Program Files\CrowdStrike\FalconSensor\ where the parent process is a scheduled task named “Antivirus Quarantine Cleanup”.

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune deployment agents extract application installers (MSI or CAB files) to local temp folders (C:\Windows\Temp or C:\Users\<User>\AppData\Local\Temp) prior to execution. This extraction often utilizes a lockless unpacking mechanism that triggers the rule during mass software rollouts.
  • Filter/Exclusion: Exclude events where the