MPRESS v2.XX x86 - no .NET

Hunt Hypothesis

This rule identifies the execution of MPRESS, a tool commonly used by adversaries to compress and obfuscate PE files, facilitating stealthy payload delivery or in-memory execution without relying on .NET frameworks. Proactively hunting for this behavior allows the SOC team to detect low-severity initial access or lateral movement activities that may otherwise go unnoticed due to the tool’s lightweight footprint and lack of standard .NET indicators.

YARA Rule

rule mpress_2_xx_x86 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		last_edit="24/03/2013"
		description="MPRESS v2.XX x86  - no .NET"

	strings:
		$signature1={60 E8 00 00 00 00 58 05 [2] 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 88 04 31 75 F6}

	condition:
		$signature1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy x86 application installer (e.g., setup.exe from an older version of Adobe Acrobat or Java) uses MPRESS to compress its internal resources to reduce disk footprint and improve load times. This is standard behavior for many traditional Windows applications that are not built on the .NET framework.

  • Filter/Exclusion: Exclude the specific executable path if it resides in a known application directory (e.g., C:\Program Files (x86)\Adobe\... or C:\Program Files (x86)\Java\...) and the parent process is a known installer service (e.g., msiexec.exe or setup.exe).

• Scenario: An enterprise patch management agent (e.g., SCCM, WSUS, or a third-party tool like ManageEngine) downloads a compressed x86 patch package and decompresses it using MPRESS during the installation phase. The compression is applied to the binary payload before it is written to disk or executed.

  • Filter/Exclusion: Exclude processes spawned by known patch management services (e.g., ccmexec.exe, wuauserv.exe, or emagent.exe) or those running within the C:\Windows\CCM\ or C:\Program Files (x86)\ManageEngine\ directories.

• Scenario: A developer or IT admin uses a utility like 7-Zip or WinRAR to extract a self-extracting archive (SFX) that contains an x86 binary compressed with MPRESS. The extraction process triggers the decompression routine, which may be detected as the MPRESS signature.

  • Filter/Exclusion: Exclude processes where the parent process is a known archive tool (e.g., 7z.exe, WinRAR.exe, WinRAR.exe) or where the working directory is