This rule identifies the presence of JDPack, a Java-based packer often used by adversaries to obfuscate malicious code and evade static analysis in Java applications. Proactively hunting for this indicator in Azure Sentinel helps SOC teams uncover hidden threats in Java workloads that may be leveraging packing techniques to bypass traditional signature-based detections.
rule JDPack: Packer PEiD
{
meta:
author="malware-lu"
strings:
$a0 = { 60 E8 [4] 5D 8B D5 81 ED [4] 2B 95 [4] 81 EA 06 [3] 89 95 [4] 83 BD 45 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Java Application Deployment via CI/CD Pipelines: In environments using Jenkins or GitLab CI, build agents frequently package Java applications into JAR files using tools like maven or gradle. If the YARA rule matches the standard structure of these generated JARs (which are ZIP archives containing specific class files), it may flag every successful build artifact.
target/, build/, dist/) or exclude processes spawned by known CI/CD agent binaries (e.g., java.exe launched by jenkins-agent.jar or gitlab-runner).Legacy Java Web Application Updates: During scheduled maintenance windows, IT teams may manually update legacy Java web applications (e.g., Tomcat, WebLogic) by replacing JAR files in application server directories (WEB-INF/lib/). These JARs often contain standard Java class structures that match the JDPack signature, especially if they are not heavily obfuscated.
C:\Program Files\Apache Software Foundation\Tomcat 9.0\webapps\*\WEB-INF\lib\) or exclude changes made by service accounts with known maintenance privileges during defined maintenance windows.Java IDE Caching and Compilation: Developers using IntelliJ IDEA or Eclipse may trigger the rule when the IDE compiles Java source code into .class files and packages them into temporary JARs for local testing or hot-swapping. These artifacts reside in user-specific cache directories and are transient but may be scanned before deletion.
C:\Users\<username>\.IntelliJIdea<version>\system\caches\, `C