PECompactv09781

Hunt Hypothesis

This rule detects the presence of PECompact-packed executables, a technique adversaries may use to compress malware binaries to evade static analysis and reduce file size. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to identify potentially obfuscated payloads that could be staging for execution or lateral movement within the environment.

YARA Rule

rule PECompactv09781
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the PECompact utility (or its variants like PECompact.exe) by a DevOps engineer or build server to compress executable files for reduced disk footprint or faster deployment. This is a common practice in CI/CD pipelines or when preparing installers for distribution.
  • Filter/Exclusion: Exclude processes where the parent process is a known build agent (e.g., Jenkins.exe, AzureDevOpsAgent.exe, TeamCity.exe) or where the command line contains arguments typical of compression tasks (e.g., /c, compress, minify).
• Scenario: A legacy application installer or setup wizard (e.g., setup.exe for older enterprise software like legacy ERP or CAD tools) invokes PECompact internally during the installation phase to optimize the size of installed binaries.
  • Filter/Exclusion: Exclude events where the parent process name matches known installer executables (e.g., msiexec.exe, setup.exe, install.exe) and the file path of the compacted binary resides within a standard application directory (e.g., C:\Program Files\, C:\Program Files (x86)\).
• Scenario: An automated maintenance script or scheduled task (e.g., a PowerShell script running via Task Scheduler) that periodically compresses log files or temporary executables to manage disk space on application servers.
  • Filter/Exclusion: Exclude processes initiated by Task Scheduler (svchost.exe with specific service names) or powershell.exe where the working directory is a known maintenance or temp folder (e.g., C:\Temp\, C:\Maintenance\) and the target file extension is .exe or .dll in a non-system path.
• Scenario: A security team or IT support staff manually runs PECompact on a