PECompactv110b5

Hunt Hypothesis

This hunt detects the presence of PECompact v1.10b5 packed executables that may indicate an adversary utilizing compression to obscure malicious code and evade static analysis. A SOC team should proactively hunt for this signature in Azure Sentinel to identify potentially benign yet suspicious artifacts that could serve as a precursor to more complex attack chains or lateral movement activities.

YARA Rule

rule PECompactv110b5
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PECompactv110b5 detection rule, tailored for an enterprise environment:

• Scenario: Microsoft Defender Antivirus Self-Update Execution

  • Context: The Windows Update service (wuauserv) or the Microsoft Defender service (SenseService) frequently executes compacted PE binaries during scheduled update cycles to download and install new definition packages. These binaries often match the PECompactv110b5 signature due to their optimized packaging structure.
  • Filter/Exclusion: Exclude processes with the image path containing \Program Files\Windows Defender\MpCmdRun.exe or \System32\wuauclt.exe where the parent process is svchost.exe. Additionally, filter out events occurring during the defined maintenance window (e.g., 01:00 – 05:00 local time).

• Scenario: Sysinternals Process Explorer or ProcDump Usage

  • Context: Security analysts and system administrators often utilize Sysinternals tools like ProcDump.exe or ProcessExplorer.exe to capture memory dumps or analyze running processes. These tools are distributed as compacted PE executables that trigger the rule when launched manually or via scheduled tasks for health checks.
  • Filter/Exclusion: Create a whitelist based on the file hash of the specific Sysinternals tool versions currently deployed (e.g., Sysinternals Suite v2024). Alternatively, exclude any process where the command line contains arguments like -ma, -accepteula, or -dumpifhung.

• Scenario: Automated Backup Client Operations (Veeam/Commvault)

  • Context: Enterprise backup agents such as Veeam Agent for Windows or Commvault MediaAgent often spawn compacted helper processes to manage data compression and indexing. These background jobs