ASDPackv10asd

Hunt Hypothesis

This rule identifies the presence of ASDPack, a known executable packer often used by adversaries to compress and obfuscate malicious payloads, thereby evading static analysis and signature-based detection. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to uncover dormant or stealthy threats that may be leveraging packing techniques to hide their true intent within the environment.

YARA Rule

rule ASDPackv10asd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 [3] 00 00 00 00 00 00 00 40 00 00 [2] 00 00 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 00 [2] 00 00 10 00 00 00 ?? 00 00 00 [2] 00 00 [2] 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy:

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., an old ERP client or specialized engineering tool) that was compiled with an older version of the ASDPack packer to reduce file size. The binary is pushed to endpoints via Group Policy Software Installation or SCCM, triggering the YARA rule on the file system.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\) or exclude binaries signed by the known vendor’s code-signing certificate if the signature is valid.

• Scheduled Maintenance Scripts for Backup Agents:

  • Scenario: A scheduled task runs a small, packed utility script or executable (e.g., a custom wrapper for Veeam or Commvault backup agents) that uses ASDPack to obfuscate simple logic or reduce footprint. This runs daily during maintenance windows, causing consistent detections on the host where the agent resides.
  • Filter/Exclusion: Exclude processes or files matching the specific path of the maintenance utility (e.g., C:\ProgramData\BackupTools\maintenance.exe) or exclude detections if the parent process is a known service host (e.g., svchost.exe or taskeng.exe) and the file hash matches a known-good baseline.

• Third-Party Plugin or Add-on Installation:

  • Scenario: A developer or power user installs a third-party plugin for a common enterprise tool (e.g., a custom Jira plugin, a specific Chrome extension for internal SSO, or a VS Code extension) that bundles a small native helper executable packed with ASDPack for performance or anti-tampering reasons.
  • Filter/Exclusion: Exclude files within the specific plugin/add-on directory structure (e.g., `C:\Users[User]\