ASPackv10802AlexeySolodovnikov

Hunt Hypothesis

This rule detects the presence of ASPack-packed executables, a common obfuscation technique used by adversaries to hide malicious code from static analysis tools. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially compromised endpoints or staging areas where attackers use packing to evade initial detection mechanisms.

YARA Rule

rule ASPackv10802AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy line-of-business application or internal utility is packed with the older version of ASPack (v1.0.8.02) to reduce file size or obfuscate the binary before deployment. This is common in environments where specific vendor tools have not been updated to newer packing standards.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\bin\) or specific known executable names (e.g., LegacyTool.exe) that have been verified as benign.

• Scenario: An IT administrator manually packs a small configuration script or a custom PowerShell wrapper using ASPack v1.0.8.02 to protect it from casual inspection or to bundle it with a deployment package, then copies it to a shared network drive or user desktop for testing.

  • Filter/Exclusion: Exclude files with specific extensions (e.g., .cfg, .dat) if the rule primarily targets .exe, or exclude paths under temporary working directories used by deployment tools (e.g., C:\Users\Public\Deployments\) for a defined period.

• Scenario: A scheduled maintenance job or a custom service executable that was built years ago and has not been recompiled is running from a service directory. The binary retains its original ASPack v1.0.8.02 signature, triggering the rule during a full disk scan or real-time monitoring.

  • Filter/Exclusion: Add an exclusion for specific service executables identified by their full path (e.g., C:\Program Files\InternalServices\svc_helper.exe) or by their Service Name if the detection engine supports service-based filtering.

• Scenario: A developer or QA engineer is testing a new build of an internal tool on a jump host or build server. The tool is packed with ASPack v1.