Adwind JAR PACKA

Hunt Hypothesis

This detection targets adversaries utilizing custom Java Archive (JAR) packaging to obfuscate malicious payloads and evade standard signature-based defenses within Azure Sentinel environments. Proactive hunting for this behavior is essential because JAR files are frequently used in enterprise applications, making them an ideal vector for stealthy lateral movement and initial foothold establishment that may not trigger high-severity alerts on their own.

YARA Rule

rule Adwind_JAR_PACKA : binary RAT Frutas Unrecom AlienSpy
{
 meta:
  author = "Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com"
  reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
  last_modified = "2015-11-30"
 strings:
  $b1 = ".class" ascii
  $b2 = "c/a/a/" ascii
  $b3 = "b/a/" ascii
  $b4 = "a.dat" ascii
  $b5 = "META-INF/MANIFEST.MF" ascii
 condition:
  int16(0) == 0x4B50 and ($b1 and $b2 and $b3 and $b4 and $b5)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Adwind JAR_PACKA detection rule, tailored for a legitimate enterprise environment:

• Java Development Build Pipelines

  • Scenario: CI/CD agents (e.g., Jenkins or GitLab Runners) executing Maven or Gradle builds frequently unpack and repackage Java Archive (JAR) files to resolve dependencies, compile code, or generate distribution artifacts. This activity generates high-volume file I/O on JAR structures that mimics the packing behavior of malicious payloads.
  • Filter/Exclusion: Exclude processes running under known CI/CD service accounts (e.g., svc-jenkins, gitlab-runner) and restrict detection to paths outside standard build working directories (e.g., exclude C:\Builds\* or /var/jenkins_home/workspace/*).

• Enterprise Application Server Maintenance

  • Scenario: Scheduled maintenance windows for application servers like Apache Tomcat, IBM WebSphere, or Oracle WebLogic often involve automated deployment scripts that extract, modify, and repack JAR files to push hotfixes or configuration updates without a full server restart. These administrative tasks trigger the “packing” signature defined in the Adwind rule.
  • Filter/Exclusion: Whitelist specific service executable paths (e.g., C:\Program Files\Apache Software Foundation\Tomcat 9\bin\tomcat.exe) and exclude events occurring during predefined maintenance windows (e.g., Sundays between 02:00–04:00 UTC).

• Endpoint Security Scanning Agents

  • Scenario: Real-time protection modules of EDR solutions such as CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint perform deep inspection of Java applications. During these scans, the agent may temporarily extract JAR contents to