CICompressv10

Hunt Hypothesis

This rule detects the presence of CICompress, a compression utility frequently leveraged by adversaries to stage or obfuscate payloads within CI/CD pipelines. Proactively hunting for this tool helps identify potential supply chain attacks or unauthorized code execution that may be hidden within build artifacts in the Azure Sentinel environment.

YARA Rule

rule CICompressv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legitimate use of 7-Zip or WinRAR by developers or IT support to compress large log files or source code archives for offsite backup or transfer.
  • Filter/Exclusion: Exclude processes with names 7z.exe, 7zG.exe, WinRAR.exe, or WinRAR.exe when the parent process is a known shell (explorer.exe, cmd.exe, powershell.exe) or a standard file manager.
• Scenario: Automated scheduled tasks running Robocopy or rsync wrappers that invoke compression utilities (e.g., gzip, bzip2, or zip) as part of nightly data archival jobs on file servers or build agents.
  • Filter/Exclusion: Exclude processes initiated by Task Scheduler (svchost.exe with specific service GUIDs) or schtasks.exe where the command line contains keywords like archive, backup, or compress and the destination path is a known backup share (e.g., \\backup-server\archives\).
• Scenario: Continuous Integration (CI) pipelines (e.g., Jenkins, Azure DevOps, GitHub Actions) executing build steps that package artifacts using zip, tar, or 7z commands within containerized agents or virtual machine runners.
  • Filter/Exclusion: Exclude processes running within known CI agent service accounts (e.g., svc-ci-agent, jenkins-agent) or where the working directory matches standard CI workspace paths (e.g., C:\Jenkins\workspace\, /home/runner/work/).
• Scenario: Application installers or updaters (e.g., NSIS, Inno Setup, or custom .NET installers) extracting or compressing temporary files during software deployment via SCCM