JDPackV200JDPack

Hunt Hypothesis

This rule identifies the presence of JDPack, a JavaScript packer often used by adversaries to obfuscate malicious scripts and evade static analysis in web-based attack vectors. Proactively hunting for this signature in Azure Sentinel allows the SOC to detect early-stage reconnaissance or persistence mechanisms that may be embedded in cloud-hosted applications or browser extensions before they execute harmful payloads.

YARA Rule

rule JDPackV200JDPack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 [3] E8 01 00 00 00 [6] 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses JDPack to bundle a custom Java application (e.g., a microservice or CLI tool) into a self-executable JAR file for distribution to other teams or for deployment in a containerized environment. The resulting binary contains the JDPack header and structure, triggering the YARA rule.

  • Filter/Exclusion: Exclude files located in specific development or build artifact directories (e.g., C:\Projects\*, D:\Builds\*, or \\fileserver\dev\artifacts\*) and files with extensions like .jar or .exe that are owned by service accounts or developer groups.

• Scenario: An IT administrator uses JDPack to package a legacy Java-based internal tool (e.g., a reporting utility or data migration script) that does not have a standard installer, creating a standalone executable for end-user deployment via GPO or manual copy.

  • Filter/Exclusion: Exclude executables in the C:\Program Files\ or C:\Program Files (x86)\ directories that match known internal tool names (e.g., ReportGen.exe, DataMigrator.exe) and are signed by the internal code-signing certificate or owned by the IT-Admins group.

• Scenario: A scheduled task or service account runs a Java-based backup or log rotation utility that was packaged with JDPack to ensure consistent runtime dependencies across multiple servers. The process runs from a hidden or system directory.

  • Filter/Exclusion: Exclude processes where the parent process is svchost.exe or taskeng.exe and the executable path matches known scheduled task locations (e.g., C:\Windows\System32\Tasks\ or C:\Scripts\*), specifically targeting known utility names like