EXECryptor2xxcompressedresources

Hunt Hypothesis

This detection identifies adversary behavior where malicious executables compress resources to evade signature-based analysis and reduce file size for stealthy execution. SOC teams should proactively hunt for this pattern in Azure Sentinel because resource compression often precedes data staging or lateral movement phases, allowing analysts to intercept potential threats before they escalate into high-severity incidents.

YARA Rule

rule EXECryptor2xxcompressedresources
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the EXECryptor2xxcompressedresources rule, including suggested filters and exclusions:

• Scenario: Enterprise Backup Agent Compression

  • Context: The Veeam Backup & Replication service (running as Veeam.Backup.Service.exe) initiates a scheduled job to compress large log files or temporary data archives before transmission. This process creates .zip or .7z resources that match the rule’s signature for compressed execution payloads.
  • Filter/Exclusion: Add an exclusion based on the parent process name Veeam.Backup.Service.exe and restrict detection to non-standard paths (e.g., exclude files located within C:\Program Files\Veeam\Backup).

• Scenario: Microsoft Office Document Archiving

  • Context: An administrator or a scheduled task runs the “Office 365 ProPlus” installer (Setup.exe) which internally extracts and compresses resource bundles (.cab files) during a silent update deployment. The rule interprets these internal compressed resources as potential cryptor activity.
  • Filter/Exclusion: Exclude processes where the command line contains /quiet or UPDATE flags, specifically targeting the path C:\Program Files\Microsoft Office\root\Office16\.

• Scenario: Antivirus Quarantine and Scanning

  • Context: The Symantec Endpoint Protection client (Symantec.DataCenter.exe) performs a real-time scan on a large directory, temporarily compressing files into its quarantine vault. This compression activity triggers the rule as it mimics the behavior of an encryptor/compressor tool.
  • Filter/Exclusion: Create a whitelist for processes running under the Symantec user context or exclude any file operations occurring within the specific directory `C:\ProgramData\Symant