UPX 020 EXE

Hunt Hypothesis

This detection identifies executable files packed with the UPX 0.20 version, a common technique adversaries use to compress malware binaries and evade static signature-based analysis. Proactively hunting for these packed executables in Azure Sentinel helps the SOC team uncover stealthy payloads that may be hiding in memory or on disk, reducing the risk of undetected compromise from obfuscated threats.

YARA Rule

rule UPX_020_EXE: PEiD
{
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 AF AD 0E 0E 0E 06 1F 07 16 68 00 00 BD FF FF F7 E1 93 CB 55 50 58 21 03 03 02 07 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of a standard Microsoft Office application (e.g., EXCEL.EXE or WINWORD.EXE) or other major vendor software (e.g., chrome.exe, firefox.exe) that has been packed with UPX 020 to reduce file size.
  • Filter/Exclusion: Exclude files located in standard vendor installation directories (e.g., C:\Program Files\Microsoft Office\, C:\Program Files (x86)\Google\Chrome\) or match against a known-good hash list for major enterprise applications.
• Scenario: Execution of a custom internal utility or script wrapper (e.g., deploy_tool.exe, backup_agent.exe) developed by the internal DevOps or IT team, where the developer used UPX 020 to compress the executable for distribution across the network.
  • Filter/Exclusion: Allowlist specific paths where internal tools are stored (e.g., C:\InternalTools\, D:\DevOps\Utilities\) or exclude processes initiated by known service accounts (e.g., DOMAIN\svc-devops, DOMAIN\svc-itadmin).
• Scenario: Execution of a scheduled task or service binary (e.g., log_collector.exe, metrics_agent.exe) that is part of a monitoring stack (like Datadog, New Relic, or internal telemetry agents) which may be UPX-packed to minimize footprint.
  • Filter/Exclusion: Exclude processes running under specific service names (e.g., DatadogAgent, NewRelicAgent) or exclude files in common agent installation directories (e.g., C:\ProgramData\Datadog\, C:\Program Files\New Relic\).
• Scenario: Execution of a temporary installer or self-extracting archive (e.g., setup.exe from