MPRESS v2.XX x64 - no .NET

Hunt Hypothesis

This rule detects the execution of the MPRESS x64 binary, a tool frequently used by adversaries to compress and pack executables to evade static analysis and signature-based detection. Proactively hunting for this indicator allows the SOC team to identify potential pre-execution staging or obfuscated payloads that may precede more complex post-exploitation activities within the Azure environment.

YARA Rule

rule mpress_2_xx_x64 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		last_edit="24/03/2013"
		description="MPRESS v2.XX x64  - no .NET"

	strings:
		$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31}

	condition:
		$signature1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps engineer uses MPRESS to compress a large native C++ application binary (e.g., render_engine.exe) to reduce disk footprint and improve initial load times on client machines. The binary is a pure Win32/x64 executable with no .NET dependency, matching the rule’s “no .NET” condition.

  • Filter/Exclusion: Exclude processes where the parent process is a known build or deployment tool (e.g., msbuild.exe, dotnet.exe, powershell.exe running a specific script path like C:\CI\deploy\compress.ps1) and the target file path resides in a designated build or staging directory (e.g., C:\builds\output\ or D:\staging\bin\).

• Scenario: An IT administrator performs a scheduled maintenance task using a custom PowerShell script that invokes MPRESS to compress legacy line-of-business applications before distributing them via Group Policy Software Installation (GPO) or SCCM. The compressed binaries are standard x64 executables without .NET metadata.

  • Filter/Exclusion: Exclude events where the command line contains specific flags used in the internal standardization script (e.g., /L+ for compression) and the parent process is powershell.exe or pwsh.exe with a script path matching the known maintenance job location (e.g., C:\Scripts\GPO_Maintenance\CompressApps.ps1).

• Scenario: A security team runs a periodic integrity check using MPRESS in verification mode (/V) to ensure that previously compressed binaries have not been tampered with. This is a read-only operation on existing x64 binaries that do not contain .NET assemblies.

  • Filter/Exclusion: Exclude events where the command line includes the verification flag (/V or `/