UPX 3.X

Hunt Hypothesis

This rule detects the presence of UPX 3.X packed executables, a common technique adversaries use to compress malware payloads and evade static analysis tools. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to identify potentially obfuscated binaries early, reducing the risk of undetected malicious activity within the environment.

YARA Rule

rule upx_3 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="25/02/2013"
		description="UPX 3.X"

	strings:
		$str1={60 BE 00 [2] 00 8D BE 00 [2] FF [1-12] EB 1? 90 90 90 90 90 [1-3] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01}

	condition:
		$str1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A DevOps team uses Ansible or Chef to deploy a custom, statically linked C++ utility (e.g., a log parser or config validator) that has been compressed with upx -o to reduce image size for faster network transfer.
  • Filter/Exclusion: Exclude processes where the parent process is ansible-playbook, chef-client, or puppet-agent, and the file path matches /usr/local/bin/ or /opt/tools/ with a known hash or name pattern (e.g., *.bin, *.tool).
• Scenario: An IT administrator manually installs a lightweight, UPX-compressed version of WinSCP or PuTTY on a jump host for ad-hoc SSH/SFTP tasks, bypassing the standard MSI installer to avoid dependency issues.
  • Filter/Exclusion: Exclude processes running from user-specific directories like C:\Users\<admin>\AppData\Local\Temp\ or C:\Tools\ if the parent process is explorer.exe or cmd.exe and the user is in the Administrators or ServiceAccounts group.
• Scenario: A CI/CD pipeline (e.g., Jenkins or GitLab CI) executes a UPX-compressed Go binary (e.g., golangci-lint or a custom build-checker) on a build agent node.
  • Filter/Exclusion: Exclude processes where the parent process is java.exe (Jenkins agent), node.exe (GitLab runner), or docker-cli, and the file path contains /workspace/, /builds/, or /agent/.
• Scenario: A security team runs a UPX-compressed version of Sysinternals tools (e.g., `procmon.exe