EXE32Packv13x

Hunt Hypothesis

This detection identifies 32-bit executable files packed with the v13x compression algorithm, a technique often employed by adversaries to obscure malicious code and evade signature-based scanning. Proactively hunting for these artifacts in Azure Sentinel is essential because low-severity detections of packed executables can serve as early indicators of stealthy initial access or lateral movement attempts that might otherwise be overlooked amidst routine system noise.

YARA Rule

rule EXE32Packv13x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 [5] 02 81 [2] E8 [4] 3B 74 01 ?? 5D 8B D5 81 ED }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the EXE32Packv13x detection rule, along with suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection) frequently utilize 32-bit packed executables to download and apply daily definition updates via scheduled tasks. The EXE32Packv13x signature often matches the update agent’s payload structure.
  • Filter/Exclusion: Create a process exclusion for known update agents (e.g., C:\Program Files\Microsoft Defender\MpCmdRun.exe or C:\ProgramData\CrowdStrike\FalconSensor\Tools\UpdateService.exe) and exclude file paths containing \Updates\ or \Definitions\.

• Scenario: Legacy Line-of-Business Application Installers

  • Context: Internal IT teams often deploy custom line-of-business applications using older installer frameworks (e.g., InstallShield 2019, Advanced Installer, or legacy WiX Toolset builds). These installers frequently employ the specific packing algorithm detected by this rule to compress setup binaries before execution.
  • Filter/Exclusion: Exclude processes running under the System account with a known digital signature from internal Certificate Authorities (CA) and restrict detection to file extensions .msi, .exe within the C:\Program Files\InternalApps\ directory tree.

• Scenario: Automated Patch Management Deployments

  • Context: During scheduled maintenance windows, patch management tools like Ivanti Neurons, ManageEngine Desktop Central, or SCCM (MECM) push updates to endpoints. The deployment agents often execute packed 32-bit binaries to apply