PECompact

Hunt Hypothesis

This rule detects the use of PECompact, a compression tool often employed by adversaries to reduce the size of malicious executables or legitimate binaries to evade file-based detection mechanisms. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to identify potential stealth techniques used in initial access or persistence stages, ensuring that compressed payloads are not overlooked during incident response.

YARA Rule

rule pecompact2 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="PECompact"

	strings:
		$str1={B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43} /*EntryPoint*/

	condition:
		$str1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of upx.exe (Universal Packer) by a DevOps engineer or build agent to compress native C/C++ binaries before deployment to production.
  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, npm.exe) or where the command line contains upx.exe and the working directory is within a designated source control or build artifact path (e.g., C:\Builds\, D:\Artifacts\).
• Scenario: Scheduled maintenance job running pecompact.exe or similar compression utilities to optimize legacy .NET assemblies or native DLLs during off-hours maintenance windows.
  • Filter/Exclusion: Exclude events where the process name is pecompact.exe and the parent process is svchost.exe (indicating a Windows Task Scheduler trigger) or the execution time falls within the defined maintenance window (e.g., 02:00–04:00 AM).
• Scenario: Antivirus or Endpoint Detection and Response (EDR) agents performing on-access compression or integrity checks that temporarily rewrite PE headers using internal compression modules.
  • Filter/Exclusion: Exclude processes where the parent process is a known security agent binary (e.g., MsMpEng.exe, CrowdStrike Falcon Sensor, Defender.exe) or where the image path resides in the vendor’s installation directory (e.g., C:\Program Files\Microsoft Security Client\, C:\Program Files\CrowdStrike\).
• Scenario: Third-party installer or updater (e.g., NSIS-based installers, Inno Setup) compressing payloads in memory or temporary directories during software installation or patch application.
  • Filter/Exclusion: Exclude processes where the parent