Upack 0399 Dwing additional

Hunt Hypothesis

This hypothesis targets the presence of malicious code packed with the Upack framework, a technique often used by adversaries to obscure the true nature of their payloads and evade static analysis. Proactively hunting for this specific packing signature in Azure Sentinel allows the SOC to identify stealthy malware variants that may be executing within the environment before they fully deploy their intended malicious functionality.

YARA Rule

rule Upack_0399_Dwing_additional: PEiD
{
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom build script that incorporates the Upack framework to compress and obfuscate a proprietary internal tool or agent before deployment to production servers.

  • Filter/Exclusion: Exclude files located in specific build output directories (e.g., C:\Builds\Output\, D:\Artifacts\) or exclude processes originating from known build agents (e.g., jenkins-agent.exe, azure-pipelines-agent.exe) when the file extension is .exe or .dll and the parent process is a recognized CI/CD tool.

• Scenario: An IT administrator installs a legacy line-of-business application that bundles a helper utility packed with Upack to reduce file size or protect intellectual property, which is then executed during a scheduled maintenance window.

  • Filter/Exclusion: Exclude files whose path matches known legacy application install directories (e.g., C:\Program Files\LegacyApp\bin\) and where the parent process is msiexec.exe or a known service installer, provided the file hash is registered in the approved software inventory.

• Scenario: A security team deploys a custom PowerShell-based detection script or a lightweight EDR agent that is compiled and packed using Upack to evade simple static analysis during initial testing phases.

  • Filter/Exclusion: Exclude files in the security tooling directory (e.g., C:\Tools\Security\, C:\ProgramData\EDR\) or exclude processes where the parent is powershell.exe or pwsh.exe and the working directory is within the security tools folder, ensuring the file is signed by the internal corporate certificate.

• Scenario: A game studio or media company uses a custom asset pipeline that packs shader libraries or plugin DLLs with Upack to optimize load times, which are then loaded by the game engine during development