RLPackV115V117aPlib043ap0x

Hunt Hypothesis

This detection identifies the presence of a specific packed executable or library component matching the signature RLPackV115V117aPlib043ap0x, which may indicate an adversary utilizing custom packing techniques to obscure malicious payloads within the environment. Proactive hunting for this artifact in Azure Sentinel is essential to uncover potential stealthy threats that evade standard heuristic scans by leveraging unique binary structures not yet covered by broader signature rules.

YARA Rule

rule RLPackV115V117aPlib043ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RLPackV115V117aPlib043ap0x detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Microsoft Office Click-to-Run Self-Update Execution

  • Context: The OfficeClickToRun.exe process frequently spawns child processes that utilize the RLPack library to download and install cumulative updates. These executables often match the YARA signature due to shared code libraries with known malware packers.
  • Filter/Exclusion: Exclude paths containing C:\Program Files\Microsoft Office\root\Office16\ or C:\Windows\System32\msocsetup.exe. Additionally, filter out events where the parent process is OfficeClickToRun.exe and the file hash matches a known Microsoft-signed certificate.

• Scenario: SCCM (Configuration Manager) Application Deployment

  • Context: During scheduled application deployments or software installation tasks, the SCCM client (ccmsetup.exe or CcmExec.exe) unpacks payloads that include the RLPack library structure. This is common when deploying enterprise-wide tools like Adobe Reader or Java updates via SCCM.
  • Filter/Exclusion: Create an exclusion for file paths under C:\Windows\CCM\ and processes initiated by ccmexec.exe. Implement a time-based filter to ignore detections occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) when bulk deployments are active.

• Scenario: Antivirus Engine Real-Time Scanning

  • Context: Third-party endpoint protection suites (such as CrowdStrike Falcon, McAfee Endpoint Security, or Symantec Endpoint Protection) often use the RLPack library within their scanning engines to analyze compressed