RLPackV115V117LZMA430ap0x

Hunt Hypothesis

This detection identifies potential malicious activity involving the specific RLPack archive structure (version 115/117 with LZMA compression) often utilized by adversaries to obfuscate payloads or stage initial access tools within Azure Sentinel environments. Proactive hunting for this signature is essential because, despite its low severity rating, these archives frequently serve as a stealthy entry point for advanced threats that may evade standard heuristic scans until they execute their embedded components.

YARA Rule

rule RLPackV115V117LZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 83 01 00 00 6A ?? 68 [4] 68 [4] 6A ?? FF 95 [4] 89 85 [4] EB 14 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the RLPackV115V117LZMA430ap0x detection rule, which targets LZMA-compressed archives often associated with remote administration or software deployment tools:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Software Deployment

  • Context: The SCCM client (ccmsetup.exe or wuauserv) frequently downloads and extracts .msi packages wrapped in LZMA-compressed containers to distribute updates across the enterprise. This often triggers the rule when the extraction process creates temporary archive files on disk.
  • Filter/Exclusion: Exclude processes named ccmsetup.exe, WUAHandler.exe, and any child processes spawned by them located within the C:\Windows\CCM directory path.

• Scenario: Scheduled Antivirus Definition Updates (Symantec or McAfee)

  • Context: Enterprise antivirus engines like Symantec Endpoint Protection or McAfee Total Protection use LZMA compression for their daily definition update packages. The scheduled job (AntCon.exe or McShield.exe) extracts these archives in the background, mimicking the behavior of a new archive creation event.
  • Filter/Exclusion: Create an exclusion based on the file path pattern C:\ProgramData\Symantec\... or C:\Program Files\McAfee\..., specifically targeting files with .lzh or .7z extensions generated by these specific service executables.

• Scenario: Sysinternals PsExec Remote Administration

  • Context: Administrators frequently use psexec.exe to push scripts or tools to remote machines. When transferring large payloads, PsExec often utilizes LZMA compression for the payload stream before execution, triggering the rule during the transfer phase.
  • **Filter/