Petite13c1998IanLuck

Hunt Hypothesis

This rule detects the presence of the Petite packer, a tool frequently used by adversaries to compress and obfuscate malicious executables to evade static analysis and signature-based detection. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially compromised workloads or deployed payloads that may be hiding in plain sight, ensuring that packed binaries are inspected before they execute their intended malicious logic.

YARA Rule

rule Petite13c1998IanLuck
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 50 8D 88 00 [3] 8D 90 [2] 00 00 8B DC 8B E1 68 00 00 [2] 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Use of UPX Compressed Binaries in Development/CI Pipelines

  • Scenario: Developers or CI/CD pipelines (e.g., Jenkins, GitHub Actions) compile small utility scripts or C/C++ tools and compress them using UPX to reduce size or speed up loading. The YARA rule Petite13c1998IanLuck often targets specific Petite packer signatures that can overlap with or be mimicked by UPX-compressed binaries, especially if the compression algorithm or header structure is similar.
  • Filter/Exclusion: Exclude files located in known development directories (e.g., C:\dev\, D:\builds\, /home/*/projects/) or exclude processes spawned by known build agents (e.g., jenkins.exe, runner.exe, dockerd.exe). Additionally, consider excluding files with extensions like .dll or .exe that are under a certain size threshold (e.g., < 1MB) if they are in dev folders.

• Third-Party Software Using Petite Packer for Licensing Protection

  • Scenario: Certain commercial or open-source applications (e.g., specific versions of Adobe Creative Cloud components, JetBrains IDEs, or specialized hardware drivers) use the Petite packer to protect their executables from reverse engineering or to enforce license checks. When these applications are installed or updated, the packed binary on disk triggers the YARA rule.
  • Filter/Exclusion: Maintain a whitelist of known vendor software paths (e.g., C:\Program Files\Adobe\, C:\Program Files\JetBrains\, C:\Program Files (x86)\VendorName\). Exclude files whose parent process or install source is a known trusted installer (e.g., msiexec.exe, setup.exe from a trusted vendor).