PECompactv0977

Hunt Hypothesis

This rule detects the presence of PECompact-packed executables, a technique adversaries often use to compress and obfuscate malicious payloads to evade static analysis and signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to identify potentially hidden or stealthy malware that may have been deployed via phishing or lateral movement, reducing the risk of undetected compromise in the environment.

YARA Rule

rule PECompactv0977
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of PECompact executable by a deployment automation tool (e.g., Ansible, Puppet, or SCCM) during a mass software update cycle.
  • Filter/Exclusion: Exclude processes where the parent process is a known configuration management agent (e.g., ansible-playbook.exe, puppet-agent.exe, SCCMClient.exe) or where the image path resides in a standard deployment directory (e.g., C:\Program Files\SCCM\, C:\ansible\).
• Scenario: A developer or QA engineer manually running PECompact.exe from a local build folder to optimize a custom application binary before release.
  • Filter/Exclusion: Exclude events where the user account belongs to a specific developer or QA security group (e.g., Dev-Team, QA-Engineers) and the image path is located within a user profile or a designated build workspace (e.g., C:\Users\<user>\builds\, D:\projects\).
• Scenario: A CI/CD pipeline agent (e.g., Jenkins, GitLab Runner, or Azure DevOps Agent) executing PECompact as part of a post-build optimization step in a containerized or virtualized build environment.
  • Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent binary (e.g., jenkins-agent.jar, gitlab-runner.exe, vsts-agent.exe) or where the process is running inside a known container runtime path (e.g., C:\ProgramData\docker\, C:\Program Files\containerd\).
• Scenario: A legacy application installer or updater (e.g., for Adobe, Oracle, or SAP components) invoking PECompact to reduce the footprint of installed binaries during a scheduled maintenance window.

  ---