EXEPackerv70byTurboPowerSoftware

Hunt Hypothesis

This detection identifies the presence of executable files packed by Turbo Power Software’s v70 packer, which adversaries often leverage to obfuscate malicious payloads and evade signature-based scanning. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to uncover hidden threats that may bypass initial defenses due to their compressed structure, ensuring early visibility into potential supply chain or fileless attacks.

YARA Rule

rule EXEPackerv70byTurboPowerSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C3 83 [2] 2E [4] B9 [2] 8C C8 8E D8 8B F1 4E 8B FE }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the EXEPackerv70byTurboPowerSoftware detection rule, along with suggested filters or exclusions:

• Scenario: Deployment of TurboPower VCL (Visual Component Library) updates via SCCM/Intune.

  • Context: When IT administrators push a new version of the TurboPower VCL framework to developer workstations using Microsoft Endpoint Configuration Manager (SCCM), the installation executable (TurboPowerSetup.exe) often triggers this rule as it is packed by the same engine.
  • Filter/Exclusion: Add an exclusion for the specific installer hash or path: C:\Program Files\TurboPower\VCL\Installer\*.exe and exclude process names containing TurboPowerSetup.

• Scenario: Execution of legacy custom reporting tools by Finance Department.

  • Context: The Finance team utilizes a proprietary reporting suite built on the TurboPower framework that runs nightly via Windows Task Scheduler to generate month-end ledgers. The scheduled job launches a packed executable (ReportGen.exe) which matches the rule signature.
  • Filter/Exclusion: Create an exclusion based on the parent process and path: Exclude C:\Apps\Finance\Reports\ReportGen.exe when the parent process is TaskHost.exe or svchost.exe.

• Scenario: Automated backup of TurboPower-based development environments.

  • Context: During nightly backups, Veeam Backup & Replication scans and processes active instances of TurboPower applications running in the R&D department. The backup agent interacts with the packed binaries, causing the detection engine to flag the activity as a potential new packed executable execution.
  • Filter/Exclusion: Exclude the rule for any process spawned by VeeamTransport.exe or VeeamAgentService.exe, specifically targeting paths within `C