ASPack v212 additional

Hunt Hypothesis

This hypothesis targets the use of ASPack v212, a legacy executable packer often employed by adversaries to compress and obfuscate malicious payloads to evade static analysis and signature-based detection. Proactively hunting for this specific version in Azure Sentinel allows the SOC to identify dormant or low-and-slow threats that may have slipped past initial endpoint defenses by leveraging known packing characteristics to uncover hidden malware in memory or on disk.

YARA Rule

rule ASPack_v212_additional: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via Group Policy

  • Scenario: An IT administrator deploys a legacy internal business application (e.g., a custom inventory management tool) that was packed with ASPack v2.12 to reduce file size. The executable is copied to C:\Program Files\InternalTools\ via a Group Policy Object (GPO) software installation policy, triggering the YARA rule on the endpoint during the initial copy or execution.
  • Filter/Exclusion: Exclude files located in C:\Program Files\ or C:\Program Files (x86)\ where the parent folder name matches known internal application directories (e.g., *InternalTools*, *LegacyApps*) and the file hash is in the approved baseline list.

• Third-Party Backup Agent Installation

  • Scenario: A vendor-provided backup agent (e.g., a specific version of Acronis or Veeam endpoint agent) uses ASPack v2.12 for its installer or service binary. When the agent is installed or updated via a scheduled task (\Microsoft\Windows\... or a vendor-specific scheduled task), the YARA rule triggers on the service executable in C:\Program Files\BackupAgent\bin\.
  • Filter/Exclusion: Exclude processes or files where the parent process is a known installer (e.g., msiexec.exe, setup.exe) or where the file path contains *BackupAgent* or *Veeam*/*Acronis* and the process name matches the vendor’s service executable (e.g., vsssvc.exe, acronis_service.exe).

• Scheduled Task for Log Rotation/Compression

  • Scenario: A custom PowerShell script or a small C++ utility packed with ASPack v2.