RLPackv118BasicLZMAAp0x

Hunt Hypothesis

This rule detects the presence of the RLpack v1.18 packer using BasicLZMA compression, a technique often employed by adversaries to compress malicious payloads and evade static signature-based detection. Proactively hunting for this specific packing algorithm in Azure Sentinel allows the SOC to identify potentially obfuscated executables in memory or on disk before they can be executed or further manipulated by an attacker.

YARA Rule

rule RLPackv118BasicLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: The rlpack.exe utility (version 1.18) is executed by a legacy application installer or a custom build script to compress large data files before deployment. Since this specific version of RLpack uses the Basic LZMA algorithm, it matches the YARA signature.

  • Filter/Exclusion: Exclude processes where the parent process is a known installer (e.g., msiexec.exe, setup.exe, or 7z.exe) or where the command line arguments contain specific flags associated with compression tasks (e.g., -c, --compress, or specific file extensions like .7z or .lzma in the target path).

• Scenario: A scheduled maintenance job runs a custom PowerShell or Batch script that invokes rlpack.exe to archive log files or temporary build artifacts in a CI/CD pipeline or nightly backup routine.

  • Filter/Exclusion: Exclude executions originating from specific scheduled task paths (e.g., C:\Windows\System32\Tasks\ or C:\ProgramData\CI\) or filter based on the working directory being a known build/backup folder (e.g., C:\Builds\, C:\Backups\).

• Scenario: A developer or sysadmin manually runs rlpack.exe from a command prompt to compress a large dataset for transfer, using the default LZMA compression setting which aligns with the “BasicLZMA” part of the rule name.

  • Filter/Exclusion: Exclude processes where the user context is a specific service account (e.g., svc_backup, dev_ci) or where the process tree includes a terminal emulator (e.g., cmd.exe, powershell.exe, conhost.exe) as the immediate parent, indicating manual or scripted execution rather than direct application launch.

• Scenario: A third