RLPackFullEdition117Ap0x

Hunt Hypothesis

This detection identifies the presence of the RLPackFullEdition117Ap0x malware signature on endpoints within the Azure Sentinel environment, indicating potential initial access or lateral movement by an adversary utilizing this specific toolset. A proactive hunt is recommended to validate whether detected instances represent benign software deployments or active threats that could evolve into higher-severity incidents if left unmonitored.

YARA Rule

rule RLPackFullEdition117Ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 [4] 8D 9D [4] 33 FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the RLPackFullEdition117Ap0x detection rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Context: The SCCM client service (ccmsetup.exe or wuauserv) executes the RLPack installer during a scheduled maintenance window to deploy full edition patches across the enterprise. This often triggers the rule because the installer mimics the behavior of the targeted threat by unpacking and executing components in the %TEMP% directory.
  • Filter/Exclusion: Create an exclusion based on the parent process name ccmexec.exe or wuauserv.exe. Additionally, exclude file paths containing \Microsoft Endpoint Configuration Manager\ from the detection scope.

• Scenario: Scheduled Antivirus Definition Updates via CrowdStrike Falcon

  • Context: The CrowdStrike Falcon sensor (FalconService) runs a scheduled job to update its local definition database. During this process, it extracts and verifies RLPack components which match the YARA signature’s heuristic for legitimate software installation patterns.
  • Filter/Exclusion: Add an exclusion for processes with the command line containing --update or running under the user context SYSTEM. Specifically, exclude file paths located within C:\ProgramData\CrowdStrike\.

• Scenario: Enterprise Software Installation via Ivanti Neurons

  • Context: The Ivanti Control Suite pushes a software bundle update to endpoints. The installation agent (IvantiAgent.exe) executes the RLPack installer as part of a dependency chain for a larger application suite (e.g., Adobe Acrobat Pro or Office 365 updates), triggering the rule due to the unpacking activity in C:\Program Files\.