FixupPakv120

Hunt Hypothesis

This detection identifies the presence of the FixupPakv120 artifact via YARA scanning to uncover potential legacy or embedded software components that may serve as a foothold for adversaries. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to assess its legitimacy and mitigate risks associated with unknown or outdated packages that could be leveraged for lateral movement or persistence.

YARA Rule

rule FixupPakv120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 00 00 00 00 5D 81 ED [2] 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 [2] 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FixupPakv120 detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update Service

  • Context: The wuauserv (Windows Update) service frequently downloads and installs definition packs that match the YARA signature of FixupPakv120, particularly when Microsoft pushes cumulative security updates. This often occurs during off-hours maintenance windows.
  • Suggested Filter/Exclusion: Create a process exclusion for C:\Windows\System32\usoclient.exe and C:\Windows\System32\wuauserv.exe. Additionally, filter alerts where the parent process is svchost.exe with the service name “WUAUService” during the defined maintenance window (e.g., 01:00–05:00 local time).

• Scenario: Deployment of Microsoft Endpoint Configuration Manager (SCCM/MECM) Packages

  • Context: When IT administrators deploy software updates or configuration packages using SCCM, the client agent (ccmsetup.exe or ccmexec.exe) often extracts and installs components that trigger the FixupPakv120 signature. This is common during mass rollout events for new applications like Office 365 updates.
  • Suggested Filter/Exclusion: Exclude processes running under the SCCM client installation path (C:\Program Files (x86)\Microsoft Configuration Manager\). Implement a rule to suppress alerts where the process command line contains keywords such as --install, --update, or specific SCCM package IDs known to contain this payload.

• Scenario: Execution of Third-Party Patch Management Tools (e.g., Ivanti or ManageEngine)

  • Context: Enterprise