← Back to SOC feed Coverage →

PROPACKv208

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-20T11:00:00Z · Confidence: medium

Hunt Hypothesis

This rule detects the presence of the PROPACKv208 YARA signature, which identifies specific malicious or suspicious code patterns often associated with low-severity threats or early-stage infection artifacts. Proactively hunting for this indicator allows the SOC team to identify potential footholds or dormant payloads in Azure Sentinel that may not yet trigger high-severity alerts, enabling early containment before lateral movement occurs.

YARA Rule

rule PROPACKv208
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C D3 8E C3 8C CA 8E DA 8B 0E [2] 8B F1 83 [2] 8B FE D1 ?? FD F3 A5 53 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar