ASPackv101bAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of files packed with the ASPack v10.1b compressor, a technique often employed by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this behavior in Azure Sentinel is essential because low-severity packing events can serve as an early indicator of stealthy threats that may bypass signature-based defenses until they exhibit more aggressive runtime activity.

YARA Rule

rule ASPackv101bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ASPackv101bAlexeySolodovnikov YARA rule, including targeted filters and exclusions:

• Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During nightly maintenance windows, SCCM pushes compressed installer packages (often packed with ASPack) to endpoints. The YARA rule detects the executable payload within these deployment agents as a potential obfuscated binary.
  • Filter/Exclusion: Exclude processes spawned by ccmsetup.exe or wuauserv.exe where the parent process is SMS_EXECUTIVE. Alternatively, add a file path exclusion for files located in C:\Windows\CCM\Logs\ and C:\Program Files (x86)\Microsoft Configuration Manager\.

• Scenario: Antivirus Signature Updates via Symantec Endpoint Protection

  • Context: The Symantec client service periodically downloads and unpacks signature definition updates. These update binaries are frequently compressed using ASPack to reduce bandwidth usage, triggering the detection logic on the temporary extraction folder.
  • Filter/Exclusion: Create a rule exclusion for any process named SymCorp.exe or Rtvscan64.exe. Additionally, exclude file paths containing \Program Files\Symantec Endpoint Protection\Content\Updates\ to ignore transient update artifacts.

• Scenario: Scheduled Backup Job Execution via Veeam Agent

  • Context: A scheduled task runs the Veeam backup agent which utilizes ASPack-compressed helper utilities to compress and transfer data blocks. The detection engine flags these helper executables as suspicious due to their packed structure.
  • Filter/Exclusion: Exclude processes where the command line contains VeeamAgent.exe or VeeamService.exe. Implement a path-based