PECompactv20betaJeremyCollake

Hunt Hypothesis

This rule detects the presence of PECompact, a specific executable compression tool often used by adversaries to reduce the size of malware payloads and evade basic file-based detection mechanisms. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially obfuscated binaries early, ensuring that compressed executables are not overlooked during initial triage or endpoint monitoring.

YARA Rule

rule PECompactv20betaJeremyCollake
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 05 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the PECompact utility (specifically version 2.0 beta) by a developer or build engineer to optimize the size of a custom C++ application before deployment.
  • Filter/Exclusion: Exclude processes where the parent process is a known IDE (e.g., devenv.exe, code.exe) or build tools (e.g., msbuild.exe, dotnet.exe) and the command line contains arguments like /compact or /optimize.
• Scenario: A scheduled maintenance job runs a legacy installer or patcher that includes the PECompact binary to compress large native libraries (e.g., libcrypto.dll, libssl.dll) during a monthly patch cycle.
  • Filter/Exclusion: Exclude events where the process path resides in a standard patching directory (e.g., C:\Patches\, C:\Updates\) and the execution time aligns with the documented maintenance window (e.g., 02:00–04:00 AM).
• Scenario: A security team performs a manual test of the YARA rule by executing the PECompactv20beta sample binary in an isolated test VM or a designated “canary” host.
  • Filter/Exclusion: Exclude hosts tagged with a specific AD group (e.g., SOC-Test-VMs) or exclude processes where the command line explicitly contains a test identifier (e.g., --test-mode or yara-test).
• Scenario: A third-party vendor’s proprietary backup or archival tool bundles the PECompact engine to compress executable files during nightly backups, running under a service account.
  • Filter/Exclusion: Exclude processes where the parent process is a known vendor service (e.g., vendor_backup_svc.exe) and the user context