RLPackV115V117Dllap0x

Hunt Hypothesis

This hypothesis targets the execution of specific RLPack versions (1.15 and 1.17) that utilize DLL injection or API hooking techniques, a common method for malware to maintain persistence and evade detection. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify low-severity, potentially stealthy implantations before they progress to more impactful post-exploitation activities.

YARA Rule

rule RLPackV115V117Dllap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Framework Compilation Artifacts: When developers or build pipelines compile C# or VB.NET applications using older versions of the .NET Framework (pre-4.5) or specific custom compilers, the resulting DLLs may retain specific header structures or packing signatures that match the RLPackV115V117 pattern. This is common in on-premises CI/CD servers (e.g., Jenkins, TeamCity) where build agents generate artifacts locally before deployment.

  • Filter/Exclusion: Exclude files located in standard build output directories (e.g., C:\BuildAgent\work\, D:\CI\output\) or files with a .dll extension that were created within the last 24 hours by known build service accounts (e.g., svc-jenkins, svc-teamcity).

• Third-Party Application Updater Binaries: Many enterprise applications (such as Adobe Creative Suite, Oracle Java, or legacy ERP clients like SAP) use proprietary updaters that download and extract temporary DLLs to perform version checks or patches. These temporary files often reside in user-specific temp directories (%TEMP%, %LOCALAPPDATA%\Temp) and may be packed in a way that triggers the YARA rule before being moved to their final location.

  • Filter/Exclusion: Exclude detections where the file path contains \Temp\ or \tmp\ and the parent process is a known updater executable (e.g., AdobeGCClient.exe, javaw.exe, SapSetup.exe).

• Virtual Machine Snapshot/Restore Operations: During Hyper-V or VMware snapshot restore processes, or when using disk imaging tools like Acronis or Veeam for backup/restore, virtual disks are mounted and files are streamed to the host. The temporary extraction of DLLs during these I/O-intensive operations can result in files being scanned while in