RLPackFullEdition117iBoxaPLibAp0x

Hunt Hypothesis

This detection identifies the presence of a specific YARA signature associated with the RLPack Full Edition software, which may indicate legitimate application deployment or potential supply chain compromise involving this library. A proactive hunt is recommended to validate whether these instances are authorized installations or unexpected artifacts that could serve as an initial foothold for adversaries leveraging known software components within the Azure Sentinel environment.

YARA Rule

rule RLPackFullEdition117iBoxaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF [15] EB 0F FF 74 37 04 FF 34 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the RLPackFullEdition117iBoxaPLibAp0x detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates via ESET Endpoint Protection

  • Context: The nightly update job for ESET Endpoint Protection (often running under the eset.exe or eset_service.exe process) downloads and unpacks signature definition packs. These packages frequently contain compressed libraries that match the “RLPack” structure identified by the YARA rule, triggering an alert when the installer extracts files to %ProgramData%\ESET\ESET Endpoint Security\.
  • Suggested Filter: Add a process exclusion for eset.exe and eset_service.exe where the command line contains keywords like “update”, “install”, or “unpack”. Alternatively, exclude file paths matching C:\ProgramData\ESET\*.

• Scenario: Deployment of Microsoft Office 365 ProPlus via SCCM/Intune

  • Context: During a mass deployment or patching window, the System Center Configuration Manager (SCCM) or Intune agent executes the Office Click-to-Run installer (OfficeC2RClient.exe). This process extracts large XML and binary configuration packs that mimic the signature of the RLPack library structure, specifically when installing the “Full Edition” suite components.
  • Suggested Filter: Exclude processes named OfficeC2RClient.exe or setup.exe running under the user context SYSTEM or specific service accounts (e.g., NT SERVICE\Microsoft Office Click-to-Run Service).

• Scenario: Automated Backup and Archiving by Veeam Agent

  • Context: The Veeam Agent for Windows runs a scheduled backup job that creates compressed archives of application data. The internal compression engine utilizes