mPack 003 DeltaAziz

Hunt Hypothesis

This hypothesis targets the presence of the mPack 003 DeltaAziz malware variant, a known component of the mPack family often used for initial access and persistence in Windows environments. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary establishes deeper footholds or deploys additional payloads.

YARA Rule

rule mPack_003_DeltaAziz: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5 }
        $b = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses Git for Windows or SourceTree to perform a git pull or git clone operation on a repository containing binary assets (e.g., pre-compiled DLLs, model files, or embedded executables) that happen to match the mPack_003_DeltaAziz signature. The YARA rule may flag the temporary file created during the unpacking or checkout process.

  • Filter/Exclusion: Exclude files located in standard source control cache directories (e.g., C:\Users\<User>\AppData\Local\Temp\git*, C:\Users\<User>\.git, or C:\Program Files\Git\) or exclude processes like git.exe, git-remote-https.exe, and SourceTree.exe when the file path contains .git or objects.

• Scenario: An administrator installs or updates Adobe Creative Cloud or Microsoft Office via a silent installer (msiexec.exe or setup.exe) that extracts temporary installation files to C:\Windows\Temp or C:\Users\<User>\AppData\Local\Temp. The YARA rule may match a specific temporary DLL or executable component used during the installation phase.

  • Filter/Exclusion: Exclude files with paths containing C:\Windows\Temp\, C:\Users\<User>\AppData\Local\Temp\, or C:\ProgramData\Package Cache\ when the parent process is msiexec.exe, setup.exe, or uninstall.exe associated with known vendor GUIDs (e.g., Adobe, Microsoft).

• Scenario: A scheduled task runs 7-Zip (7z.exe) or WinRAR (WinRAR.exe) to extract a compressed archive (.zip, .rar, `.