RLPackV111ap0x

Hunt Hypothesis

This detection identifies the execution of a specific RLPack variant (version 111) that may indicate an adversary utilizing custom or obfuscated payloads to establish initial access or execute malware within the environment. Proactively hunting for this signature in Azure Sentinel is essential to uncover low-severity, stealthy activities that might evade standard heuristic controls and prevent potential lateral movement before escalation occurs.

YARA Rule

rule RLPackV111ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RLPackV111ap0x detection rule, including targeted filters and exclusions:

• Scenario: Automated deployment of Microsoft Office updates via SCCM (System Center Configuration Manager) triggers the rule when the update agent extracts compressed payloads containing the RLPack signature structure.

  • Filter/Exclusion: Exclude processes running under the C:\Windows\CCM\ directory path and specifically filter for process names ccmsetup.exe or msiexec.exe when initiated by the “System” account.

• Scenario: The enterprise antivirus engine (e.g., CrowdStrike Falcon or Microsoft Defender) performs a real-time heuristic scan on a large, compressed archive (.zip or .7z) containing legacy application installers that match the RLPack signature pattern.

  • Filter/Exclusion: Create an exclusion for the specific file extensions .cab, .msi, and .zip when accessed by the security agent’s core processes (csfalcon.exe or MsMpEng.exe) during non-business hours (e.g., 02:00–06:00).

• Scenario: A scheduled PowerShell script runs nightly to archive logs from the Exchange Server environment, utilizing a custom compression utility that embeds the RLPack header structure.

  • Filter/Exclusion: Exclude file paths located within C:\Program Files\Microsoft\Exchange Server\ and filter for process names powershell.exe where the command line arguments contain specific keywords like -ArchiveLog or -Compress.

• Scenario: The IT operations team uses a third-party backup solution (e.g., Veeam Backup & Replication) to create incremental backups of virtual machine disks, which generates temporary staging files matching the detection logic.

  • **Filter/Exclusion