NTKrnlPackerAshkbizDanehkar

Hunt Hypothesis

This rule detects the presence of the NTKrnlPacker, a known executable packer associated with the AshkbizDanehkar malware family, which adversaries use to compress and obfuscate payloads to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints early, preventing the packed malware from executing its malicious logic or establishing persistence within the environment.

YARA Rule

rule NTKrnlPackerAshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses the NTKrnlPacker tool (or a similar custom kernel-mode packer) to compress and obfuscate a proprietary driver or DLL for deployment to a specific test cluster or legacy application server.
  • Filter/Exclusion: Exclude files located in specific development or staging directories (e.g., C:\Dev\Projects\DriverBuild\) or exclude processes initiated by known build agents (e.g., jenkins.exe, github-actions-runner.exe) when the file extension is .sys or .dll and the size is below a certain threshold (e.g., < 50MB).
• Scenario: An IT administrator manually packs a large, infrequently updated kernel module or firmware image for offline transfer to an air-gapped segment using a script that invokes the packer binary.
  • Filter/Exclusion: Exclude events where the parent process is a known administrative tool (e.g., powershell.exe, cmd.exe) and the user account belongs to a specific security group (e.g., Domain Admins, IT_Ops_Team) during business hours.
• Scenario: A scheduled maintenance job on a legacy application server uses a wrapper script to re-pack a critical kernel driver before a monthly patch cycle, triggering the YARA rule on the output file.
  • Filter/Exclusion: Exclude files matching specific known-good hashes or names (e.g., legacy_driver_packed.sys) that are generated by a scheduled task named Monthly_Driver_Maintenance or similar.
• Scenario: A security team performs a controlled test of kernel-mode packers in an isolated lab environment to validate detection coverage, inadvertently triggering the rule on the test host.
  • Filter/Exclusion: Exclude hosts tagged with a specific CMDB attribute (e.g., `Environment=Lab