UPXv20MarkusLaszloReiser

Hunt Hypothesis

This detection identifies executable files packed with the UPX v2.0 compressor, a technique adversaries frequently employ to obfuscate malicious payloads and evade static signature-based analysis. Proactive hunting for this behavior in Azure Sentinel is essential because UPX-packed binaries often conceal hidden execution logic that may bypass initial security controls, requiring deeper dynamic inspection to uncover potential threats.

YARA Rule

rule UPXv20MarkusLaszloReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 FF 96 [4] 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 [4] 8B AE [4] 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 [2] 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the UPXv20MarkusLaszloReiser detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Deployment of Microsoft Office Click-to-Run Updates

  • Context: The Microsoft Office Update service (OfficeClickToRun.exe) frequently utilizes UPX compression to package update payloads (version 20.x) before installation. This is a standard, scheduled background task that occurs daily on endpoints.
  • Suggested Filter/Exclusion: Create an exclusion based on the file path C:\Program Files\Microsoft Office\root\Office16\ and the process name OfficeClickToRun.exe. Alternatively, filter out any UPX-compressed files where the embedded signature matches “Microsoft Corporation” in the PE header.

• Scenario: Execution of Sysinternals Suite Utilities

  • Context: Administrators routinely use tools from the Microsoft Sysinternals suite (e.g., ProcessExplorer.exe, ProcMon.exe, or PsExec.exe) for troubleshooting and remote management. These utilities are often distributed as UPX-packed executables to reduce download size, triggering alerts when launched by IT staff.
  • Suggested Filter/Exclusion: Exclude files located in the directory C:\ProgramData\Microsoft\Sysinternals\ or filter based on the publisher “Microsoft Corporation” and specific file hashes known for the latest Sysinternals releases.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Major antivirus vendors (such as CrowdStrike, SentinelOne, or Symantec) deliver definition updates via UPX-compressed installers or engine modules. These are triggered by scheduled jobs running under the SYSTEM account during off-peak hours.
  • Suggested Filter/Exclusion: Implement a process