mPack003DeltaAziz

Hunt Hypothesis

This detection identifies potential malicious activity associated with the specific YARA signature mPack003DeltaAziz, which may indicate the presence of a known threat or variant within the environment. Proactive hunting for this indicator in Azure Sentinel is essential to validate its occurrence and assess any lateral movement or data exfiltration risks before they escalate into higher-severity incidents.

YARA Rule

rule mPack003DeltaAziz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the mPack003DeltaAziz detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The YARA rule flags the background update process of Microsoft Defender Antivirus or Symantec Endpoint Protection. These tools frequently download and unpack delta definition files (often named mpPack003 or similar) which trigger the signature due to their compressed structure and specific header patterns.
  • Filter/Exclusion: Create a file path exclusion for the update service binaries, specifically targeting C:\Program Files\Microsoft Defender\MsMpEng.exe and C:\ProgramData\Microsoft\Windows Defender\Platform\*.dll. Additionally, exclude processes spawned by the specific scheduled task \Microsoft\Windows\Windows Defender\Windows Defender Update.

• Scenario: Office 365 Click-to-Run Deployment

  • Context: During major Office updates or initial deployments, the Office Click-to-Run Service (OfficeC2RClient.exe) extracts delta packages to update application components. The rule misidentifies these extraction artifacts as potential malicious payloads because they mimic the structure of the targeted mPack signatures.
  • Filter/Exclusion: Exclude the process OfficeC2RClient.exe and its associated working directory: C:\Program Files\Microsoft Office Root\Office16\ClickToRun. A specific filter should also be applied to any file operations occurring within the AppData\Local\Microsoft\Office\ClickToRun folder.

• Scenario: Enterprise Backup Agent Scans

  • Context: The rule triggers when Veeam Backup & Replication or Rubrik agents perform incremental (delta) backups of system state files. These agents compress and package data