PECompactv1242v1243

Hunt Hypothesis

This hypothesis targets the presence of PECompact-packed executables, a technique often used by adversaries to compress malware payloads and evade signature-based detection. Proactively hunting for these specific packing signatures in Azure Sentinel allows the SOC to identify potentially obfuscated binaries that may be executing on endpoints or stored in cloud storage, reducing the risk of undetected malicious activity.

YARA Rule

rule PECompactv1242v1243
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Use of UPX Compressors in Development/CI Pipelines: Developers or CI/CD systems (e.g., Jenkins, GitHub Actions) frequently use UPX to compress executable binaries to reduce download size or memory footprint. If the YARA rule PECompactv1242v1243 targets specific UPX version signatures or header patterns, it will flag these compressed binaries.

  • Filter/Exclusion: Exclude files located in known build artifact directories (e.g., C:\builds\, /tmp/artifacts/) or exclude processes originating from CI runner services (e.g., jenkins.exe, agent.exe) that are writing to temporary or build output folders.

• Open Source Tools with UPX Compression: Many popular open-source command-line tools and utilities (e.g., wget, curl, python executables in some distributions, or specific network scanners like nmap in certain builds) are distributed with UPX compression to keep their size small. If these tools are installed in standard system paths, they will trigger the rule.

  • Filter/Exclusion: Create an allowlist for specific known-good hashes (SHA256) of these tools, or exclude files located in standard installation directories like C:\Program Files\ or C:\Program Files (x86)\ where the parent process is a known service or application installer.

• Java/Python Runtime JARs or Native Extensions: Some Java applications or Python packages that include native C/C++ extensions may bundle small, UPX-compressed .dll or .so files. These are often loaded by the JVM or Python interpreter during normal application startup.

  • Filter/Exclusion: Exclude files with extensions .jar (if the rule mistakenly scans them) or .dll/.so files that are