PECompactv2xx

Hunt Hypothesis

This rule detects the presence of PECompact v2.x compressed executables, a technique often used by adversaries to reduce the size of malicious payloads and evade basic file-based detection mechanisms. Proactively hunting for these compressed binaries in Azure Sentinel allows the SOC to identify potentially obfuscated malware or trojans that may have been dropped on endpoints or stored in cloud storage before they are executed or expanded.

YARA Rule

rule PECompactv2xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Distribution via ClickOnce or MSIX Packaging: Applications deployed through Microsoft ClickOnce or modern MSIX packaging often use PE compression to reduce download size and disk footprint. This is common for enterprise line-of-business (LOB) apps, internal portals, or developer tools like Visual Studio extensions.

  • Filter/Exclusion: Exclude files located in standard ClickOnce cache directories (e.g., %LOCALAPPDATA%\Apps\2.0) or MSIX package directories (%LOCALAPPDATA%\Packages\). Additionally, whitelist known publisher hashes or specific file paths for internal LOB applications.

• Java Native Interface (JNI) or .NET Native AOT Compilation: When Java applications are packaged using GraalVM Native Image or .NET applications are compiled using Native AOT, the resulting executables are often compressed or optimized. This is frequently seen in CI/CD pipelines, microservices deployed via container images, or standalone CLI tools used by DevOps teams.

  • Filter/Exclusion: Exclude binaries in standard build artifact directories (e.g., target/, bin/, dist/) within source control repositories or CI/CD agent workspaces. Whitelist specific tool names like native-image, dotnet, or java if the executable is a wrapper script or launcher.

• Antivirus or Endpoint Protection Agent Updates: Many EDR and AV solutions (e.g., CrowdStrike Falcon, Carbon Black, Defender for Endpoint) use compressed PE formats for their updaters or auxiliary components to minimize memory footprint and speed up deployment. These updates are typically triggered by scheduled tasks or service restarts.

  • Filter/Exclusion: Exclude processes or files owned by known AV/EDR vendors (e.g., CrowdStrike, CarbonBlack, Microsoft Defender). Whitelist specific update service names (e.g., FalconUpdateService, `CB