This detection identifies the execution of a specific unpacking utility (Upackv032BetaDwing) that adversaries often leverage to extract and analyze malicious payloads during the initial stages of an attack. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to uncover stealthy file extraction activities that may precede more significant compromise events, ensuring early visibility into potential supply chain or malware delivery mechanisms.
rule Upackv032BetaDwing
{
meta:
author="malware-lu"
strings:
$a0 = { BE 88 01 [2] AD 50 [2] AD 91 F3 A5 }
$a1 = { BE 88 01 [2] AD 50 ?? AD 91 ?? F3 A5 }
condition:
$a0 or $a1
}
This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Upackv032BetaDwing detection rule, including suggested filters and exclusions:
Scenario: Automated Deployment of Microsoft Office Updates via SCCM/Intune
.msi or .cab packages containing the Upackv032BetaDwing payload during scheduled maintenance windows to patch Office 365 components. This extraction process mimics the behavior of a potential unpacking malware.Microsoft.WindowsUpdate.OrchestratorWorker.exe or ccmsetup.exe service accounts, specifically targeting file paths within C:\Program Files\Microsoft Office\Updates\.Scenario: Antivirus Real-Time Scanning of Compressed Archives
.zip or .7z archive containing software installers. The AV engine’s internal decompression module invokes the Upackv032BetaDwing signature during the scan, causing a duplicate alert.MsMpEng.exe, Symantec Antivirus Console) and the file extension is .zip, .7z, or .rar.Scenario: Scheduled Backup Jobs Utilizing 7-Zip Compression
7z.exe utility to compress data before transmission. The rule detects the internal unpacking routine of these