SimplePack121build0909Method2bagie

Hunt Hypothesis

This rule targets specific packed executables associated with the SimplePack121 build, indicating potential use of obfuscation techniques to hide malicious code from static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC team to identify low-severity, stealthy payloads that may be used for initial access or lateral movement before they escalate in severity.

YARA Rule

rule SimplePack121build0909Method2bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment: Enterprise environments often deploy custom internal tools or legacy line-of-business applications built with older versions of the .NET Framework (e.g., 3.5 or 4.0). The SimplePack YARA signature frequently matches the standard System.IO.Packaging or System.IO.Compression assemblies embedded in these executables.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalTools\, C:\Program Files (x86)\LegacyApps\) or exclude processes where the parent is a known service host (svchost.exe for specific services) and the file extension is .exe or .dll within these trusted paths.

• Java JAR Packaging and .NET Interop: In mixed-stack environments, Java applications may use .NET interop libraries or embed .NET assemblies within JAR files for specific functionality. The YARA rule may trigger on the SimplePack library when it is loaded as a dependency by a Java Virtual Machine (JVM) process.

  • Filter/Exclusion: Exclude files if the parent process is java.exe or javaw.exe, or if the file path contains jre/ or jdk/ directories. Additionally, exclude if the file name ends in .jar and contains embedded .dll files that match the signature.

• Scheduled Backup and Archive Jobs: Enterprise backup solutions (e.g., Veeam, Commvault, or custom PowerShell scripts) often use .NET-based compression libraries to create .zip or .tar.gz archives. The SimplePack library is commonly used in these scripting contexts for file packaging.

  • Filter/Exclusion: Exclude files if the parent process is a known backup agent (e.g., vssadmin.exe, `comm