PackMasterv10

Hunt Hypothesis

This hunt hypothesis targets adversaries who utilize the PackMaster v10 packing tool to obfuscate malicious executables and evade signature-based detection by altering file structures. Proactively hunting for this behavior in Azure Sentinel is critical because packed files often mask embedded payloads that standard static analysis might miss, allowing attackers to establish a foothold before triggering higher-severity alerts.

YARA Rule

rule PackMasterv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
	$a1 = { 60 E8 01 [3] E8 83 C4 04 E8 01 [3] E9 5D 81 ED D3 22 40 ?? E8 04 02 [2] E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PackMasterv10 detection rule, including suggested filters and exclusions:

• Scenario: Deployment of internal enterprise software updates via Microsoft Endpoint Configuration Manager (SCCM/MECM) or Intune.

  • Context: IT administrators frequently package custom line-of-business (LOB) applications using the PackMaster v10 tool to ensure consistent installation across thousands of endpoints before pushing them through SCCM. These legitimate installers trigger the rule upon execution on user workstations.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for file paths matching C:\Program Files\Microsoft Configuration Manager\AdminConsole and process names ending in ccmsetup.exe. Additionally, exclude files where the digital signature publisher is “Your Enterprise Name” (e.g., CN=Enterprise CA).

• Scenario: Execution of nightly scheduled backup jobs using Veeam Backup & Replication.

  • Context: The enterprise utilizes PackMaster v10 to compress and bundle large configuration logs or agent updates before the nightly backup window runs. When the Veeam service executes these bundled files on backup servers, the YARA rule flags them as potential packed executables.
  • Suggested Filter/Exclusion: Exclude processes running under the Veeam.Backup.Service user account and file paths located within C:\Program Files\Veeam\Backup and Replication. Add a time-based filter to ignore alerts generated between 02:00 AM and 05:00 AM on backup servers.

• Scenario: Automated patching of third-party development tools (e.g., Visual Studio or JetBrains IDEs) via Chocolatey.

  • Context: The DevOps team uses Chocolatey to manage developer environments, where specific toolchains are wrapped using PackMaster v10 for version control and dependency management