PECompactv140b2v140b4

Hunt Hypothesis

This rule detects the presence of PECompact-packed executables, a technique often used by adversaries to compress malware binaries to evade signature-based detection and reduce file size. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially obfuscated payloads that may have been deployed via phishing or lateral movement, ensuring that low-severity threats are not overlooked before they escalate.

YARA Rule

rule PECompactv140b2v140b4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Framework Applications: Older enterprise applications built on the .NET Framework 4.0 or 4.5 (indicated by the v140 runtime dependency) often use PECompact for binary size optimization to reduce deployment footprint. This is common in internal line-of-business tools, legacy ERP modules, or custom reporting dashboards.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalTools\ or C:\Apps\LegacyERP\) where the executable name matches known legacy application binaries (e.g., ReportGen.exe, DataSync.exe).

• Vendor-Specific Middleware or Agents: Third-party monitoring agents, database connectors, or middleware components (e.g., specific versions of IBM WebSphere, Oracle middleware, or custom Java/.NET bridges) may be compiled with PECompact to optimize performance and memory usage. These are typically installed by vendor scripts and reside in vendor-specific directories.

  • Filter/Exclusion: Exclude paths containing vendor-specific identifiers (e.g., C:\Program Files\IBM\, C:\Oracle\Middleware\, or C:\VendorAgents\) and correlate with known vendor service names (e.g., IBMWebSphereSvc, OracleAgent).

• Scheduled Maintenance or Cleanup Jobs: Automated scheduled tasks (e.g., Windows Task Scheduler jobs) that run small utility scripts or cleanup utilities to manage log rotation, temp file deletion, or disk defragmentation. These utilities are often small, single-purpose executables that benefit from compression.

  • Filter/Exclusion: Exclude executables in C:\ProgramData\Maintenance\ or C:\Scripts\ that are invoked by known scheduled task names (e.g., DailyLogCleanup, TempFileSweeper) and have a file size below a certain threshold (e.g.,