This rule identifies executable files compressed with the PECompact v1.20 packer, a technique often used by adversaries to reduce binary size and evade static signature-based detection. Proactively hunting for these packed binaries in Azure Sentinel helps uncover stealthy malware or trojans that may be executing on endpoints or stored in cloud assets, allowing the SOC to investigate potential compromises before they escalate.
rule PECompactv120v1201
{
meta:
author="malware-lu"
strings:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy .NET Application Deployment via Group Policy
InventoryTracker.exe) to a fleet of Windows 10 endpoints using Group Policy Object (GPO) software installation. The executable was compiled with an older version of PECompact (v1.20 or v1.20.1) to reduce file size for faster network transfer, triggering the YARA rule during the initial file copy and execution.C:\Program Files\, C:\Program Files (x86)\) that are signed by a known internal code-signing certificate (e.g., CN=InternalDevTeam) and have a file size less than 50MB. Alternatively, whitelist specific hashes of known legacy binaries.Scheduled Backup Utility Execution
VeeamAgent.exe or AcronisBackup.exe) runs on a nightly scheduled task. The vendor’s installer or a specific helper component was packed with PECompact v1.20.1 to optimize disk space on the backup server. The YARA rule triggers when the service starts and loads the packed DLL or executable into memory.svchost.exe) or a specific vendor service executable (e.g., VeeamSvc.exe) and where the file path contains vendor-specific keywords (e.g., \Veeam\, \Acronis\). Ensure the exclusion applies only to specific service accounts (e.g., svc_backup).Development Environment: Local Testing of Compressed Binaries