PECompactv14x

Hunt Hypothesis

This rule detects the presence of PECompact-packed executables, a technique adversaries use to compress malware binaries to evade static analysis and signature-based detection. Proactively hunting for these packed files in Azure Sentinel helps identify potentially obfuscated threats that may have been deployed via phishing or lateral movement, allowing the SOC to investigate suspicious artifacts before they execute or propagate.

YARA Rule

rule PECompactv14x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When deploying older line-of-business applications (e.g., legacy Java applets, old .NET WinForms apps, or specific vendor tools like older versions of SAP GUI or Citrix Receiver) that were compiled using PECompact to reduce file size, the binary will match the signature during initial GPO-based software distribution or manual admin installation.

  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\VendorName\) or specific known-good hashes for these legacy applications. Alternatively, exclude processes spawned by gpupdate.exe or gpedit.msc during initial deployment windows.

• Third-Party Antivirus/EDR Self-Update Components: Some older or specialized security agents, or their updater components, may use PECompact to compress their update payloads or helper executables to minimize bandwidth usage and disk footprint. This is common in environments running older versions of enterprise AV or specific endpoint management tools.

  • Filter/Exclusion: Whitelist the specific executable names associated with the security suite’s updater (e.g., avupdate.exe, edr_agent_updater.exe) or exclude files in the vendor’s specific installation directory (e.g., C:\Program Files\Symantec\... or C:\Program Files\CrowdStrike\...).

• Scheduled Backup or Cleanup Scripts: Administrative scheduled tasks (Task Scheduler) that run custom PowerShell or VBScript wrappers to invoke compressed utility binaries (e.g., a compressed version of 7z.exe, zip.exe, or a custom log rotation tool) to perform nightly backups or disk cleanup. These utilities are often compressed to save space on shared network drives or client machines.

  • Filter/Exclusion: Exclude execution contexts where the parent process is svchost.exe (for Task Scheduler) or powershell.exe/