RLPack120BasicEditionaPLibAp0x

Hunt Hypothesis

This detection identifies the presence of a specific YARA signature (RLPack120BasicEditionaPLibAp0x) that indicates potential library or application component activity within the environment. Although currently flagged with low severity, proactively hunting for this pattern in Azure Sentinel allows the SOC team to establish a behavioral baseline and quickly distinguish between legitimate software updates and early-stage adversary reconnaissance activities.

YARA Rule

rule RLPack120BasicEditionaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RLPack120BasicEditionaPLibAp0x YARA rule, tailored to a legitimate enterprise environment:

• Scenario: Automated deployment of Microsoft Office updates via SCCM (System Center Configuration Manager).

  • Context: The wsappx or msiexec.exe process extracts and installs Office components that match the “Basic Edition” library signature within the rule’s scope.
  • Filter/Exclusion: Exclude processes where the parent is ccmsetup.exe or wuauserv.exe running from C:\Windows\CCM\ or C:\Program Files (x86)\Microsoft Office\, specifically targeting file paths containing \Office16\Library\.

• Scenario: Scheduled antivirus definition updates by Microsoft Defender Antivirus.

  • Context: The MpCmdRun.exe service downloads and unpacks the “Basic Edition” protection library during its daily 2:00 AM maintenance window, triggering a match on the unpacked DLL or manifest file.
  • Filter/Exclusion: Create an exclusion for the process name MsMpEng.exe (or MpCmdRun.exe) when the file path starts with C:\ProgramData\Microsoft\Windows Defender\Definition\.

• Scenario: Execution of a third-party backup agent (e.g., Veeam or Acronis) performing incremental scans.

  • Context: The backup agent extracts metadata and library files from protected volumes, where the “aPLib” compression signature is detected in the temporary staging area used by the Basic Edition module.
  • Filter/Exclusion: Exclude file paths located within C:\Program Files\BackupAgent\Temp\ or D:\VeeamBackup\Staging\, and filter out process names