SimplePack 111 Method 2NT bagieTMX h

Hunt Hypothesis

This rule identifies the presence of SimplePack, a lightweight .NET assembly packer, which adversaries use to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to detect potentially hidden .NET executables in memory or on disk before they are unpacked and executed to compromise workloads.

YARA Rule

rule SimplePack_111_Method_2NT_bagieTMX_h: PEiD
{
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses SimplePack (a lightweight .NET packer) to obfuscate a custom internal utility or CLI tool before deploying it to a staging environment for performance testing or to reduce binary size.

  • Filter/Exclusion: Exclude files located in specific development or staging directories (e.g., C:\Projects\InternalTools\, D:\Staging\) or exclude files owned by service accounts used for build/deploy pipelines (e.g., svc-build, app-deploy) when the parent process is a known build tool like MSBuild.exe or dotnet.exe.

• Scenario: An IT administrator runs a custom PowerShell script or C# console application packed with SimplePack to automate bulk user account resets or group policy updates during a scheduled maintenance window.

  • Filter/Exclusion: Exclude execution if the parent process is powershell.exe or pwsh.exe and the command line contains specific administrative verbs (e.g., -ResetPassword, -UpdateGPO) or if the file path resides in a trusted administrative tools directory (e.g., C:\AdminTools\, C:\Scripts\).

• Scenario: A third-party application installer or updater uses a packed helper executable (packed with SimplePack) to perform silent installations or registry modifications, which is a common technique to bypass basic file system checks or reduce footprint.

  • Filter/Exclusion: Exclude files that are signed by a trusted third-party vendor (e.g., Microsoft, Adobe, VMware) or exclude execution if the parent process is a known installer binary (e.g., msiexec.exe, setup.exe, install.exe) and the file has a valid Authenticode signature.

• Scenario: A security team or red team uses SimplePack to pack a benign canary token or a