UPX 0.80 to 1.24

Hunt Hypothesis

This rule identifies the presence of UPX-packed executables, a common technique adversaries use to compress malware payloads to evade static analysis and signature-based detection. Proactively hunting for these files in Azure Sentinel allows the SOC to uncover hidden or obfuscated binaries that may indicate stealthy persistence or initial access mechanisms within the environment.

YARA Rule

rule upx_0_80_to_1_24 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="UPX 0.80 to 1.24"

	strings:
		$str1={6A 60 68 60 02 4B 00 E8 8B 04 00 00 83 65 FC 00 8D 45 90 50 FF 15 8C F1 48 00 C7 45 FC FE FF FF FF BF 94 00 00 00 57}

	condition:
		$str1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: Administrators often deploy older, unpatched line-of-business applications (e.g., legacy POS systems or niche engineering tools) that were compiled with UPX versions between 0.80 and 1.24 to reduce file size. These executables are frequently pushed to endpoints via Group Policy Object (GPO) software installation or SCCM/MECM task sequences.

  • Filter/Exclusion: Allowlist the specific file paths where these legacy applications are installed (e.g., C:\Program Files\LegacyApp\bin\*.exe) or create a GPO-based exclusion for the specific software package name if the detection engine supports GPO-aware filtering.

• Scheduled Maintenance Scripts for Third-Party Utilities: IT operations teams may use scheduled tasks (Task Scheduler) to run maintenance scripts or small utility executables (such as disk cleanup tools, log rotators, or backup agents) that are UPX-packed to minimize footprint. These tasks often run under the SYSTEM or a dedicated service account at specific intervals (e.g., daily at 02:00 AM).

  • Filter/Exclusion: Exclude execution of UPX-packed binaries when the parent process is svchost.exe (for service-based tasks) or Taskeng.exe (for Task Scheduler) and the binary resides in known utility directories (e.g., C:\ProgramData\VendorTools\ or C:\Scripts\Maintenance\).

• Development and Testing Environments: Developers and QA engineers frequently use UPX to compress test binaries, debuggers, or lightweight CLI tools (like curl, wget, or custom Python/Ruby wrappers) during local testing or CI/CD pipeline execution on build agents. These files are often located in user-specific directories or temporary build folders.

  • Filter/Exclusion: Exclude UPX detections for