PECompactv0978

Hunt Hypothesis

This hypothesis targets the presence of PECompact-packed executables, a technique often used by adversaries to compress malware binaries and evade static analysis tools. Proactively hunting for these files in Azure Sentinel allows the SOC team to identify potentially obfuscated payloads that may be executing on endpoints or stored in cloud storage, reducing the risk of undetected malicious activity.

YARA Rule

rule PECompactv0978
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the PECompact command-line tool during a scheduled build pipeline or CI/CD job to reduce the size of executable artifacts before deployment.
  • Filter/Exclusion: Exclude processes where the parent process is a known build agent (e.g., jenkins.exe, agent.exe, vstsagent.exe) or where the command line contains arguments like -c (compress) or -d (decompress) and the working directory matches the repository path.
• Scenario: A developer or sysadmin manually running PECompact.exe from a local development machine to optimize a custom utility or plugin before sharing it with the team.
  • Filter/Exclusion: Exclude events originating from user accounts with the Developer or SysAdmin group membership, or filter out processes where the binary path resides in standard development directories (e.g., C:\Users\<User>\Projects\, C:\dev\).
• Scenario: An automated application installer or updater (e.g., for Adobe, Microsoft Office, or custom enterprise software) invokes PECompact as part of its post-installation optimization routine.
  • Filter/Exclusion: Correlate with the parent process name (e.g., msiexec.exe, setup.exe, install.exe) and exclude if the parent process is signed by a trusted enterprise publisher or if the event occurs within a specific time window following a known software installation.
• Scenario: A legacy line-of-business (LOB) application or custom internal tool uses PECompact as a library or helper binary to compress configuration files or small executables at startup.
  • Filter/Exclusion: Maintain a whitelist of known LOB application directories (e.g., C:\Program Files\InternalApp\) and exclude any PECompact execution where the parent process or the