KBysPacker028BetaShoooo

Hunt Hypothesis

This detection identifies files packed with the KBysPacker028BetaShoooo tool, which adversaries often utilize to obfuscate malicious payloads and evade signature-based scanning. Proactively hunting for these instances in Azure Sentinel allows the SOC team to uncover stealthy threats that may bypass initial ingestion filters due to their low severity classification and generic packing characteristics.

YARA Rule

rule KBysPacker028BetaShoooo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the KBysPacker028BetaShoooo detection rule, along with recommended filters and exclusions:

• Scenario: Legitimate deployment of Microsoft Office updates via SCCM (System Center Configuration Manager) or Intune.

  • Context: The OfficeC2RClient.exe or Setup.exe processes often utilize the specific packing signature detected by this rule when distributing cumulative updates to endpoints during business hours.
  • Suggested Filter/Exclusion: Exclude process paths containing \Microsoft Office\*\OfficeClickToRun.exe and parent processes named ccmsetup.exe (SCCM) or IntuneManagementExtension.exe.

• Scenario: Scheduled execution of enterprise antivirus definition updates (e.g., CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection).

  • Context: During the nightly maintenance window, the AV engine’s update service downloads and unpacks new signature databases using a packer that matches the rule’s heuristic, triggering alerts on the C:\Program Files\...\UpdateService.exe process.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under the user context NT SERVICE\AntivirusUpdateService and file paths matching *\CrowdStrike\Falcon\* or *\Symantec\*.exe.

• Scenario: Execution of third-party backup agents (e.g., Veeam, Commvault, or Rubrik) performing incremental backups.

  • Context: Backup agents often compress and pack data streams before transmission; the VeeamTransport.exe or CommServe.exe processes frequently instantiate a packed executable that triggers this YARA rule during scheduled backup jobs.
  • Suggested Filter/Exclusion: Exclude process names containing Veeam, CommServe, or `RubrikAgent