MPRESS v2.XX .NET

Hunt Hypothesis

This rule detects the use of MPRESS, a .NET assembly compression tool, which adversaries often employ to obfuscate malicious payloads and evade static analysis during initial access or execution phases. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to identify hidden .NET executables that may be staging for further compromise, ensuring visibility into low-severity but high-impact obfuscation techniques.

YARA Rule

rule mpress_2_xx_net : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="24/03/2013"
		description="MPRESS v2.XX .NET"

	strings:
		$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}

	condition:
		$signature1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps team uses MPRESS to compress large .NET application binaries (e.g., MyService.exe) to reduce deployment package size before pushing them to a CI/CD pipeline or artifact repository. The compression step is executed by a build agent service account.

  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., dotnet.exe, msbuild.exe, jenkins-agent.exe, or teamcity-agent.exe) and the target file path resides in a build workspace directory (e.g., C:\builds\, C:\jenkins\workspace\).

• Scenario: An IT administrator manually compresses a legacy .NET application installer (Setup.exe) using MPRESS from the command line to optimize disk space on a shared network drive or before archiving to tape.

  • Filter/Exclusion: Exclude executions where the user belongs to the IT_Admins or App_Support security group and the working directory is a known admin tooling path (e.g., C:\Tools\MPRESS\ or C:\AdminScripts\).

• Scenario: A scheduled maintenance job runs MPRESS as part of a nightly “application optimization” task to compress .NET DLLs in a specific application folder before a maintenance window.

  • Filter/Exclusion: Exclude processes spawned by the Task Scheduler (svchost.exe with TaskschdM service) where the task name matches a known pattern (e.g., *Optimize*, *Compress*) and the target path is within a designated application directory (e.g., C:\Apps\LegacySystem\bin\).

• Scenario: A software vendor’s installer or update service uses MPRESS internally to compress .NET components during a silent installation or patch application.