PECompactv166

Hunt Hypothesis

This rule detects the presence of PECompact-packed executables, a technique adversaries use to compress binary files to reduce file size and potentially evade signature-based detection. Proactively hunting for these artifacts in Azure Sentinel helps identify suspicious or malicious payloads that may have been deployed to endpoints, ensuring that compressed binaries are not overlooked during initial triage.

YARA Rule

rule PECompactv166
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via SCCM/MECM: Enterprise environments often deploy older, unmanaged line-of-business (LOB) applications that were compiled with PECompact to reduce file size for faster network transfer. These executables may be copied to user profiles or application directories during scheduled maintenance windows.
  • Filter/Exclusion: Exclude files located in known application installation directories (e.g., C:\Program Files\LegacyApp\, C:\Program Files (x86)\OldTool\) or paths containing specific vendor names if the application is known to use PECompact.
• Third-Party Backup and Archiving Agents: Backup agents (such as Veeam, Acronis, or Commvault) or archive utilities may create compressed or packed temporary files during data ingestion or restoration processes. If the YARA rule scans temporary directories or backup staging areas, these legitimate packed artifacts can trigger alerts.
  • Filter/Exclusion: Exclude files in temporary backup staging directories (e.g., C:\ProgramData\Veeam\Backup\, C:\Temp\Acronis\) or files with specific extensions associated with backup agents (e.g., .vbk, .tmp in specific agent folders).
• Installer Staging for Legacy Software: Installers for older software versions (pre-Windows 10 era) often use PECompact to compress the payload. When IT admins manually install or re-image workstations, the installer executable or its extracted components may reside in the C:\Windows\Installer or C:\Temp directories during the process.
  • Filter/Exclusion: Exclude files in C:\Windows\Installer\ and C:\Temp\ if the parent process is a known installer (e.g., msiexec.exe, setup.exe from a specific vendor) or if the file age is less than 24 hours