RLPack120BasicEditionLZMAAp0x

Hunt Hypothesis

This detection identifies the presence of a specific Lempel-Ziv-Markov Algorithm (LZMA) packed executable signature often associated with benign software installers or legitimate application updates. A SOC team should proactively hunt for this pattern in Azure Sentinel to distinguish normal operational noise from potential low-severity packing techniques that could be leveraged by adversaries to obfuscate malicious payloads within the Basic Edition environment.

YARA Rule

rule RLPack120BasicEditionLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RLPack120BasicEditionLZMAAp0x detection rule, including suggested filters and exclusions:

• Scenario: Automated Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Acronis Cyber Protect frequently utilize LZMA compression algorithms to package large data sets before transmission. The RLPack120 signature often triggers when these agents spawn compression processes during scheduled nightly jobs.
  • Filter/Exclusion: Exclude the specific process paths of known backup agents (e.g., C:\Program Files\Veeam\Backup and Replication\...\vbrsvc.exe or C:\Program Files\Acronis\Agent\bin\acronis_agent_service.exe) from triggering this YARA rule.

• Scenario: Software Deployment via Endpoint Management

  • Context: When Microsoft Intune, SCCM (Configuration Manager), or Jamf pushes application updates, they often download and unpack .msi or .zip payloads compressed with LZMA. The deployment engine extracts these archives in memory, triggering the RLPack120BasicEditionLZMAAp0x signature during the installation phase.
  • Filter/Exclusion: Create a whitelist for processes running under the context of known management agents (e.g., ccmexec.exe, IntuneManagementExtension.exe) and exclude file paths containing \AppData\Local\Microsoft\WindowsApps\ or specific deployment temp folders (C:\Windows\CCM\Cache).

• Scenario: Antivirus On-Access Scanning of Compressed Archives

  • Context: When users open large compressed archives (.7z, .rar, .zip) containing nested LZMA-compressed content, the local endpoint protection suite