This rule detects the presence of the Petite packer, a tool frequently used by adversaries to compress and obfuscate malicious executables to evade static analysis and signature-based detection. Proactively hunting for this indicator allows the SOC team to identify potentially hidden payloads in memory or on disk that may be executing stealthily within the Azure Sentinel environment.
rule Petitev211
{
meta:
author="malware-lu"
strings:
$a0 = { B8 [4] 68 [4] 64 [6] 64 [6] 66 9C 60 50 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer uses a legitimate open-source build tool or compression utility (e.g., 7z, zip, or a custom Python script using zlib) to package application artifacts or logs for transfer. The specific byte pattern of the compressed header or trailer in the file matches the heuristic signature defined in Petitev211.
C:\Builds\, /var/build/) or files with extensions like .zip, .tar, .gz when the parent process is a known build tool (e.g., msbuild.exe, gradle, npm, python.exe).Scenario: An automated scheduled task (e.g., a Windows Task Scheduler job or cron job) runs a maintenance script that generates temporary log files or data dumps. The script writes data in a specific binary format that coincidentally matches the YARA rule’s pattern, particularly if the rule targets common magic bytes or structural anomalies in small files.
svc-maintenance, backup-service) within temporary directories (e.g., C:\Temp\, %TEMP%) if the file size is below a certain threshold (e.g., < 5MB) and the creation time aligns with the scheduled task’s execution window.Scenario: A legacy application or third-party plugin (e.g., an old Java-based reporting tool or a .NET assembly) writes configuration files or serialized objects that use a proprietary binary format. The YARA rule Petitev211 may be overly broad in its matching of specific byte sequences that are common in these legacy formats, leading to false positives during routine updates or config reloads.