This hypothesis targets the execution of Shrinker33, a known file compression and packing tool frequently used by adversaries to obfuscate malicious payloads and reduce binary size for stealthier delivery. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints where attackers are leveraging packers to evade static analysis and signature-based detection.
rule Shrinker33
{
meta:
author="malware-lu"
strings:
$a0 = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
condition:
$a0
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or build engineer uses 7-Zip (7z.exe) or WinRAR to compress large source code archives or log files for offsite backup or transfer. The Shrinker33 YARA rule likely matches the PE header or specific byte sequences associated with common compression algorithms or the executable itself.
7z.exe, WinRAR.exe, or tar.exe, or exclude files located in standard build directories (e.g., C:\Builds\, D:\Artifacts\) with extensions .7z, .rar, or .zip.Scenario: An IT administrator runs Ninite or Chocolatey to install or update software packages. These tools often download and execute compressed installers (e.g., .zip or .msi wrappers) that may contain embedded compression logic triggering the rule.
ninite.exe, choco.exe, or winget.exe. Additionally, exclude files with paths containing \Ninite\ or \Chocolatey\ or parent processes matching powershell.exe with arguments containing Install-Package or ninite.Scenario: A scheduled task runs Veeam Backup or Commvault agents to perform incremental backups. The backup agent may create temporary compressed snapshots or use compression libraries that match the YARA signature during the deduplication or compression phase.
veeambackup.exe, commvaultagent.exe, or backupagent.exe. Filter out events where the file path contains \Veeam\ or \Commvault\ and the process is running under a service account (e.g., DOMAIN\svc-backup).