PECompactv146

Hunt Hypothesis

This rule identifies executable files compressed with the PECompact v1.46 packer, a technique often used by adversaries to reduce binary size and evade static analysis during initial access or payload delivery. Proactively hunting for these packed binaries in Azure Sentinel allows the SOC to detect potentially obfuscated malware or trojans that may be executing on endpoints or stored in cloud storage before they trigger more advanced behavioral detections.

YARA Rule

rule PECompactv146
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy Objects (GPO)

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., a specific version of SAP GUI or older Oracle client) that was compiled with PECompact v1.46 to reduce file size. The binary is pushed to hundreds of endpoints via GPO, triggering the YARA rule on every machine during the update cycle.
  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that match specific known hashes or file names associated with the deployed legacy software. Alternatively, whitelist the specific SHA256 hash of the PECompact-compressed binary.

• Third-Party Antivirus/EDR Self-Update or Component Installation

  • Scenario: A security vendor (e.g., CrowdStrike, Carbon Black, or a specific AV engine) installs a helper utility or driver component that uses PECompact for size optimization. This often happens during scheduled maintenance windows or when a new agent version is rolled out, causing the compressed binary to appear in system directories like C:\ProgramData\ or C:\Windows\System32\.
  • Filter/Exclusion: Exclude processes or files owned by known security vendor service accounts (e.g., svc_crowdstrike, svc_edr) or located in vendor-specific subdirectories (e.g., C:\ProgramData\CrowdStrike\). Whitelist the specific path pattern for the vendor’s update/installer components.

• Scheduled Task Execution of Compressed Utility Scripts

  • Scenario: A DevOps team creates a scheduled task to run a custom cleanup or log rotation script that has been compressed with PECompact to save disk space. The task runs every night at 2:00 AM,