UPX v070 Hint WIN EP

Hunt Hypothesis

This hypothesis targets the presence of UPX-packed executables, a common technique used by adversaries to compress malware and evade signature-based detection during the initial execution phase. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to identify potentially obfuscated payloads before they establish persistence or trigger further malicious activity.

YARA Rule

rule UPX_v070_Hint_WIN_EP: PEiD
{
    strings:
        $a = { 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of a UPX-packed executable from a standard software installation directory (e.g., C:\Program Files\Adobe\Acrobat DC\AcroRdr32.exe or C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE) during a user login or application launch.
  • Filter/Exclusion: Exclude files located in standard program directories (C:\Program Files\, C:\Program Files (x86)\) that have a valid digital signature and are owned by a trusted vendor (e.g., Adobe, Microsoft, Oracle).
• Scenario: A scheduled maintenance job or service update task (e.g., Task Scheduler running C:\Scripts\UpdateAgent.exe or C:\Tools\Backup\BackupClient.exe) that is compiled with UPX to reduce size, executed by a service account or system context.
  • Filter/Exclusion: Exclude executables running from known administrative script/tool directories (e.g., C:\Scripts\, C:\Tools\, C:\Admin\) when the process parent is svchost.exe (with specific service names) or Taskeng.exe, and the file has a static hash match against a known-good baseline.
• Scenario: Deployment of a custom internal utility or agent (e.g., C:\CorpTools\InventoryAgent.exe or C:\CorpTools\LogCollector.exe) that is UPX-packed to minimize footprint, executed during a GPO software installation or manual admin push.
  • Filter/Exclusion: Exclude executables in designated corporate tool directories (e.g., C:\CorpTools\, C:\InternalApps\) that are signed by the internal corporate code-signing certificate and have a file age older than 7 days (to avoid catching newly deployed, unverified binaries immediately).