YZPack 12 UsAr additional

Hunt Hypothesis

This rule detects the presence of YZPack-packed executables, a technique often used by adversaries to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially hidden threats that may have been deployed via web shells or dropped by initial access malware, ensuring early detection of low-severity but significant obfuscation tactics.

YARA Rule

rule YZPack_12_UsAr_additional: PEiD
{
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses 7-Zip (or a similar archiver like WinRAR) to compress a large source code directory or build artifacts into a .7z or .rar file for transfer to a staging server. The YARA rule may match the specific header bytes or structural patterns of the compressed archive if it utilizes a compression algorithm or packing method that overlaps with the “YZPack” signature.

  • Filter/Exclusion: Exclude files with extensions .7z, .rar, .zip, or .tar.gz located in known development directories (e.g., C:\Projects\, D:\Builds\) or created by processes like 7z.exe, WinRAR.exe, or tar.exe.

• Scenario: An IT administrator runs a scheduled maintenance job using Veeam Backup & Replication or Commvault to create a backup snapshot. The backup agent writes a compressed, packed container file to the backup repository. If the backup software uses a proprietary or standard packing format that shares structural similarities with the YZPack signature, the file may trigger the rule upon creation or during a scan.

  • Filter/Exclusion: Exclude files located in backup repositories (e.g., \\BackupServer\Repos\, C:\BackupData\) or created by known backup service processes such as vbrsrv.exe, commvault.exe, or backupagent.exe.

• Scenario: A software vendor installs a custom application using an installer built with Inno Setup or NSIS (Nullsoft Scriptable Install System). These installers often use packed or compressed executable containers. If the installer uses a specific compression or packing method that matches the “YZPack 12 UsAr” pattern, the resulting .exe or .msi file may be flagged during a post-install integrity check