RLPackFullEdition117iBoxLZMAAp0x

Hunt Hypothesis

This YARA rule identifies the presence of the RLPack full edition 117iBox LZMA packer, a tool frequently used by adversaries to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this specific packer in Azure Sentinel helps detect early-stage fileless or packed malware that may be staging for execution or lateral movement before it fully unpacks and triggers more complex behavioral alerts.

YARA Rule

rule RLPackFullEdition117iBoxLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF [10] 6A 40 68 [4] 68 [4] 6A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a custom build script that utilizes the LZMA compression library (e.g., via 7z or python-lzma) to package application artifacts into a .7z or .lzma archive before pushing them to a private artifact repository. The YARA rule may match the specific byte patterns of the LZMA header or the “Box” identifier if the rule is overly broad in its string matching.

  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., msbuild.exe, gradle.exe, npm.exe, or python.exe) and the file path contains standard build directories like \build\, \dist\, or \artifacts\.

• Scenario: An IT administrator uses a legitimate enterprise backup or archiving tool (such as WinRAR, 7-Zip, or tar with LZMA support) to compress large log files or database dumps for off-site storage. The compressed file structure contains the specific LZMA magic bytes or header strings that trigger the rule.

  • Filter/Exclusion: Exclude files with extensions .7z, .lzma, or .tar.lzma located in designated backup or archive shares (e.g., \\fileserver\backups\, \\storage\archives\) and exclude processes named 7z.exe, WinRAR.exe, or tar.exe.

• Scenario: A CI/CD pipeline agent (e.g., Jenkins, Azure DevOps, or GitHub Actions runner) executes a step to compress test results or coverage reports using lzma or xz utilities. The temporary files created during this process reside in the agent’s workspace directory and may be scanned by the EDR agent before being deleted.

  • Filter/Exclusion: Exclude file paths