ASPackv107bDLLAlexeySolodovnikov

Hunt Hypothesis

This detection identifies the execution of a specific DLL file associated with the ASPack v107b packing tool, which adversaries often utilize to obfuscate malicious payloads and evade signature-based defenses. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy, packed executables that may bypass initial automated alerts due to their low severity classification and generic appearance.

YARA Rule

rule ASPackv107bDLLAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D [6] B8 [4] 03 C5 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ASPackv107bDLLAlexeySolodovnikov detection rule, along with recommended filters and exclusions:

• Scenario: Legitimate Deployment of Microsoft Office Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run update service (OfficeClickToRun.exe) frequently unpacks compressed DLLs using ASPack v1.07b during background updates to optimize disk usage and reduce download sizes. This is a standard behavior in enterprise environments with large user bases.
  • Filter/Exclusion: Create an exclusion based on the parent process name OfficeClickToRun.exe or the specific file path pattern C:\Program Files\Microsoft Office Root\Office16\*. Additionally, filter by the known SHA256 hash of the updater executable if available in your asset inventory.

• Scenario: Scheduled Antivirus Definition Updates (e.g., CrowdStrike or SentinelOne)

  • Context: Endpoint Detection and Response (EDR) agents often utilize ASPack to compress their own definition databases or signature DLLs before deployment. When a scheduled job runs the update service, it may trigger this rule as it unpacks the new definitions into memory.
  • Filter/Exclusion: Exclude processes belonging to known EDR vendors such as C:\Program Files\CrowdStrike\csagent.exe or C:\Program Files\SentinelOne\SentinelService.exe. Implement a time-based filter if updates only occur during specific maintenance windows (e.g., 02:00–04:00 AM).

• Scenario: Execution of Enterprise Reporting Tools (e.g., Tableau Server or Power BI Gateway)

  • Context: Business intelligence platforms like Tableau Server or the On-premises Data Gateway often load compressed visualization libraries and report components