RLPackV112V114LZMA430ap0x

Hunt Hypothesis

This rule detects the presence of executables packed with specific versions of RLPack (1.12/1.14) utilizing LZMA compression, a technique often employed by adversaries to obscure binary characteristics and evade static analysis. Proactively hunting for these signatures in Azure Sentinel helps identify potentially obfuscated malware or trojans that may have been deployed via phishing or supply chain attacks before they can establish persistence or execute their payload.

YARA Rule

rule RLPackV112V114LZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF 6A ?? 68 [4] 68 [4] 6A ?? FF 95 [4] 89 85 [4] EB ?? 60 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy or specialized build tools that utilize LZMA compression for packaging or archiving, such as 7-Zip (7z.exe) or WinRAR (WinRAR.exe), when processing large software bundles or installer packages.
  • Filter/Exclusion: Exclude files with extensions .7z, .rar, or .tar.lzma if the parent process is a known archiving utility (e.g., 7z.exe, WinRAR.exe, tar.exe) and the file size exceeds a threshold (e.g., >5MB) to distinguish from small executable payloads.
• Scenario: Running Visual Studio Code (Code.exe) or JetBrains IDEs (e.g., idea64.exe, pycharm64.exe) where the application bundles or downloads LZMA-compressed plugin packages or language server binaries during startup or update cycles.
  • Filter/Exclusion: Exclude processes where the parent executable is a known IDE or editor (e.g., Code.exe, idea64.exe) and the file path contains standard plugin or cache directories (e.g., \plugins\, \cache\, .vscode\).
• Scenario: Execution of Python or Node.js runtime environments where scripts install or unpack LZMA-compressed native modules (e.g., via pip install or npm install), often resulting in temporary LZMA-compressed archives being extracted in system temp folders.
  • Filter/Exclusion: Exclude files located in standard temporary directories (e.g., C:\Users\<User>\AppData\Local\Temp\, C:\Windows\Temp\) if the parent process is a package manager (pip.exe, npm.exe, node.exe) and the file has a timestamp within the last 15 minutes.
• Scenario: Deployment of