RLPackv118BasicDLLLZMAAp0x

Hunt Hypothesis

This detection identifies the presence of a specific packed DLL utilizing LZMA compression and RL.Pack v118 signatures, which often indicates an adversary employing obfuscation techniques to conceal malicious payloads within legitimate-looking libraries. The SOC team should proactively hunt for this signature in Azure Sentinel because such packing mechanisms are frequently used by threat actors to evade static analysis and delay the execution of their core attack logic until runtime.

YARA Rule

rule RLPackv118BasicDLLLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the RLPackv118BasicDLLLZMAAp0x detection rule, along with targeted exclusion strategies:

• Scenario: Deployment of Microsoft Office Updates via SCCM/Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes cumulative updates for the Office suite. The installer often utilizes a compressed payload containing DLLs packed with LZMA algorithms before extraction and installation.
  • Filter/Exclusion: Exclude processes where ParentImage matches C:\Program Files\Microsoft Intune Management Extension\IntuneManagementExtension.exe or C:\Windows\System32\ccmexec.exe, specifically when the file path contains \Office16\ or \Microsoft Office\.

• Scenario: Execution of Antivirus Real-Time Scanning Engines

  • Context: Endpoint protection agents (e.g., Microsoft Defender, CrowdStrike Falcon) periodically scan large archives (.zip, .7z) in user directories. The scanning engine internally extracts these archives using LZMA compression libraries, triggering the YARA signature on the temporary extraction DLLs or the scanner’s own internal modules.
  • Filter/Exclusion: Create a whitelist for known security vendor binaries. Exclude detections where ParentImage is MsMpEng.exe, FalconSensorService.exe, or C:\Program Files\Microsoft Defender Antivirus\bin\MsMpEng.exe.

• Scenario: Automated Backup Jobs Using Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often create incremental backups of application data. These tools utilize LZMA compression for their internal database logs and temporary staging files during the “Pre-Backup” phase, which can mimic the signature of a packed DLL.