RLPack118DllLZMA430ap0x

Hunt Hypothesis

This YARA rule targets a specific packed DLL utilizing LZMA compression, indicating the presence of obfuscated code often employed by adversaries to hide malicious payloads from static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially compromised endpoints or staging areas before the packed binary is executed or further manipulated.

YARA Rule

rule RLPack118DllLZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 9F 01 00 00 6A ?? 68 [4] 68 [4] 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 [4] 68 [4] 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Application Updates (e.g., Adobe Creative Cloud, Slack, Discord)

  • Scenario: Modern desktop applications frequently use LZMA-compressed installers or self-extracting archives for their update mechanisms. When the updater process (e.g., AdobeUpdate.exe or slack.exe) spawns a temporary extraction process or loads a compressed DLL, the YARA rule may match the binary signature of the LZMA container or the specific packing algorithm used by the vendor.
  • Filter/Exclusion: Exclude processes where the parent process is a known application updater (e.g., AdobeUpdate.exe, slack.exe, discord.exe) and the file path resides in the application’s local data directory (e.g., C:\Users\<User>\AppData\Local\Programs\... or C:\Program Files\...). Additionally, whitelist known vendor-signed certificates for these specific executables.

• Development Environment Tooling (e.g., Visual Studio, JetBrains IDEs, Node.js/npm)

  • Scenario: Developers often use tools that bundle dependencies or use compressed archives for caching (e.g., npm cache, pip wheels, or Maven repositories). When an IDE like Visual Studio or IntelliJ IDEA compiles code or restores dependencies, it may spawn helper processes that handle LZMA-compressed libraries or use packed DLLs for performance. The YARA rule might trigger on the temporary DLLs or the compiler/linker helper binaries that utilize LZMA compression.
  • Filter/Exclusion: Exclude processes running from standard development tool directories (e.g., C:\Program Files\Microsoft Visual Studio\..., C:\Users\<User>\.nuget\..., C:\Users\<User>\.npm\...). Whitelist specific developer tool executables (e.g., devenv.exe, idea64.exe, `node.exe