PECompactv09782

Hunt Hypothesis

This rule detects the presence of PECompact-packed executables, a technique adversaries often use to compress malware binaries to evade static analysis and signature-based detection. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially obfuscated payloads that may have been deployed via phishing or lateral movement, ensuring that compressed threats are not overlooked during initial triage.

YARA Rule

rule PECompactv09782
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer compiles a C++ application using the Intel OneAPI Compiler with the /Qipo (IPO) or /Qopt:icf (Identical COM Folding) optimization flags, which can result in binary compression or section merging that mimics PECompact signatures.

  • Filter/Exclusion: Exclude files located in standard build artifact directories (e.g., C:\Builds\, C:\Artifacts\, D:\CI\) or exclude files with specific compiler metadata strings (e.g., Intel(R) C++ Compiler) in the version resource.

• Scenario: An IT administrator uses a legitimate commercial installer or updater (e.g., Adobe Creative Cloud, Microsoft Office, or JetBrains Toolbox) that utilizes UPX or similar packers to reduce the size of the executable payload for faster network transfer.

  • Filter/Exclusion: Whitelist known publisher hashes (e.g., Adobe Inc., Microsoft Corporation, JetBrains s.r.o.) or exclude executables residing in standard application installation paths (e.g., C:\Program Files\Adobe\, C:\Program Files (x86)\Microsoft\Office\).

• Scenario: A system administrator runs a scheduled maintenance task using a tool like 7-Zip or WinRAR to compress large log files or backup archives, where the compression algorithm creates a binary structure that triggers the PECompact heuristic due to high entropy and specific section headers.

  • Filter/Exclusion: Exclude processes with names like 7z.exe, 7zG.exe, WinRAR.exe, or WinRAR.exe when the target file extension is .7z, .rar, or .zip, or exclude files with high entropy (>7.5) that are not marked as executables (M attribute).

• **Scenario