This hypothesis targets the presence of RLPack V120 packed executables utilizing LZMA compression, a technique commonly employed by threat actors to obfuscate malware payloads and evade static analysis during initial infection stages. Proactively hunting for these specific packing signatures in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious artifacts before they execute, reducing the mean time to detect (MTTD) for stealthy, packed binaries that may bypass standard heuristic detections.
rule RLPack_V120_LZMA_430_ap0x: PEiD
{
strings:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer runs a local build script using 7z (7-Zip) or LZMA compression to package application artifacts or logs for transfer. The resulting compressed archive (.7z or .lzma) is scanned by the endpoint agent, and the YARA rule matches the specific LZMA header structure and size constraints defined in RLPack_V120_LZMA_430_ap0x.
.7z, .lzma, or .tar.lzma located in standard build directories (e.g., C:\Projects\, D:\Builds\, or ~/.cache/) from YARA scanning if they are not executed directly. Alternatively, add an exclusion for processes like 7z.exe or python.exe creating these files in non-system directories.Scenario: An IT administrator uses a legitimate backup utility (e.g., Veeam, Acronis, or Windows Server Backup) that internally uses LZMA compression for backup sets. The backup agent creates temporary compressed chunks on the local disk during the backup window, triggering the detection on the temporary files before they are moved to the backup repository.
C:\ProgramData\Veeam\Backup\, C:\Windows\Backup\, or C:\Temp\Backup\) from YARA scanning. Ensure the exclusion applies to the specific service account running the backup job (e.g., svc-backup or DOMAIN\BackupAdmin).Scenario: A Java or .NET application uses a library like XZ for Java or SharpCompress to decompress or compress configuration files, model weights, or data blobs in memory or on disk. The