UPX v30 EXE LZMA Markus Oberhumer Laszlo Molnar John Reiser additional

Hunt Hypothesis

This hypothesis targets the presence of UPX-packed executables, a common obfuscation technique used by adversaries to compress malware payloads and evade signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to identify potentially compromised endpoints or suspicious binaries that may be hiding malicious code within standard compression headers.

YARA Rule

rule UPX_v30_EXE_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Application Deployment via MSI/EXE Installers: Many enterprise applications (e.g., Adobe Creative Suite, Oracle Java, or specific vendor tools like Splunk Forwarder) use UPX-compressed EXEs to reduce installer size. During scheduled software updates or new deployments, these binaries are written to disk and executed, triggering the YARA signature.
  • Filter/Exclusion: Exclude paths where the executable resides in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) and specifically whitelist known vendor installers (e.g., msiexec.exe spawning child processes in C:\Windows\Installer\ or specific app folders).
• Development and CI/CD Pipeline Artifacts: In software development environments, developers and CI/CD agents (e.g., Jenkins, GitLab CI, Azure DevOps) frequently compile and package executables using UPX to optimize release builds. These compressed EXEs are often stored in build artifact directories or temporary build spaces before being deployed.
  • Filter/Exclusion: Exclude files located in common build artifact or temporary directories (e.g., C:\builds\, C:\artifacts\, C:\temp\, C:\Users\<user>\AppData\Local\Temp\) and restrict detection to non-development user accounts or exclude processes spawned by known build agents (e.g., jenkins-agent.exe, gitlab-runner.exe).
• Legacy or Third-Party Utility Tools: Certain administrative or utility tools (e.g., older versions of 7-Zip, WinRAR, or specific network diagnostic tools like nmap.exe or tcpdump.exe in some distributions) may be distributed with UPX compression. These are often run by IT admins or service accounts for maintenance tasks.
  • Filter/Exclusion: Whitelist specific