UPX 1.00 to 1.07

Hunt Hypothesis

This rule identifies the presence of UPX packers (versions 1.00 through 1.07) in executable files, a technique frequently employed by adversaries to compress malware and evade static analysis. Proactively hunting for these specific versions allows the SOC team to surface potentially obfuscated binaries in the environment, enabling earlier detection of stealthy payloads that may be leveraging compression to hide their true functionality.

YARA Rule

rule upx_1_00_to_1_07 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		description="UPX 1.00 to 1.07"

	strings:
		$str1={60 BE 00 ?0 4? 00 8D BE 00 B0 F? FF ?7 8? [3] ?0 9? [0-9] 90 90 90 90 [0-2] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0}

	condition:
		$str1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., an old Java-based reporting tool or a specific CAD plugin) that was compiled with UPX 1.02 to reduce file size. The executable is pushed to multiple endpoints via Group Policy Preferences or a configuration management tool like SCCM, triggering the detection on the target machines.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) where the parent folder name matches known legacy application names, or exclude based on the specific SHA256 hash of the known-good binary if the deployment is controlled.

• Scheduled Maintenance Job for Log Rotation or Cleanup

  • Scenario: A scheduled task (e.g., LogCleanup.exe or TempFileDeleter.exe) runs every night at 02:00 AM to compress or archive old log files. If this utility was built using UPX 1.05 to minimize its footprint, the execution of this small, compressed binary triggers the rule during the scheduled run.
  • Filter/Exclusion: Exclude the specific executable path (e.g., C:\Scripts\Maintenance\LogCleanup.exe) or filter by the parent process being a scheduled task service (Svchost.exe with the Schedule service or Taskschd.exe) and the file extension being .exe in a known scripts/maintenance directory.

• Third-Party Agent or Monitoring Tool Update

  • Scenario: A third-party monitoring agent (e.g., a specific version of Datadog, New Relic, or a custom internal agent) undergoes an automated update. The updater or the new agent binary itself is packed with UPX 1.0