Shrinker34

Hunt Hypothesis

This rule detects the execution of Shrinker34, a lightweight executable packer often used by adversaries to compress malicious payloads and evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify potentially obfuscated malware early, reducing the risk of undetected lateral movement or persistence within the environment.

YARA Rule

rule Shrinker34
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Antivirus/EDR Self-Optimization and Cache Management:

  • Scenario: Security tools like CrowdStrike Falcon, Carbon Black, or Trend Micro often compress or “shrink” their own cache files, temporary rule databases, or memory dumps to optimize disk usage and performance. This process can temporarily create file structures that match the Shrinker34 YARA signature.
  • Filter/Exclusion: Exclude processes originating from known security vendor directories (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\Carbon Black\) or filter by parent process names such as Falcon Sensor.exe, cb.exe, or tmcc.exe.

• Software Installer Cleanup (NSIS/Inno Setup):

  • Scenario: During the installation or uninstallation of enterprise software (e.g., Adobe Creative Cloud, Microsoft Office, or VMware Workstation), installers using NSIS (Nullsoft Scriptable Install System) or Inno Setup may compress or decompress temporary files. The intermediate compressed state or the specific packing algorithm used by the installer’s temporary files can trigger the rule.
  • Filter/Exclusion: Exclude files located in temporary installer directories (e.g., %TEMP%\, C:\Windows\Installer\, or specific vendor temp folders) and filter by parent processes like unins000.exe, setup.exe, or install.exe from known vendor paths.

• Backup and Archiving Agents:

  • Scenario: Enterprise backup solutions such as Veeam Backup & Replication, Commvault, or Acronis create compressed archive files (e.g., .vbk, .cab, or custom compressed formats) during scheduled backup jobs. If the compression algorithm or file header matches the `