Hunt Hypothesis
This rule detects the presence of Shrinker v3.3, a lightweight PE packer frequently used by adversaries to compress and obfuscate malicious executables to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially packed binaries that may be hiding in memory or on disk, reducing the risk of undetected malware execution.
YARA Rule
rule Shrinkerv33
{
meta:
author="malware-lu"
strings:
$a0 = { 83 3D [3] 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }
condition:
$a0 at pe.entry_point
}
Deployment Notes
This YARA rule can be deployed in the following contexts:
- Microsoft Defender for Endpoint — Custom indicators / advanced hunting
- Email Gateway — Attachment scanning
- File Share Monitoring — Periodic scanning of shared drives
- YARA CLI — Manual threat hunting on endpoints
This rule contains 1 string patterns in its detection logic.
False Positive Guidance
- Scenario: A developer or DevOps engineer uses a legitimate PE packer (such as UPX, F-Prot, or SmartPack) to compress a custom utility or script to reduce its size for distribution or to bypass basic antivirus signature scans during a test deployment.
- Filter/Exclusion: Exclude files located in specific development or staging directories (e.g.,
C:\Dev\, C:\Staging\, C:\Temp\) or filter by process parent if the file was written by a known compiler or packer executable (e.g., upx.exe, fprot.exe).
- Scenario: An IT administrator runs a scheduled maintenance job that uses a proprietary installer or updater tool (e.g., a custom MSI wrapper or a vendor-specific patcher) which internally packs the payload using a Shrinker-style algorithm to save disk space or bandwidth during the update process.
- Filter/Exclusion: Exclude processes running from the vendor’s specific installation directory (e.g.,
C:\Program Files\VendorApp\Updates\) or filter by the specific service name or scheduled task name associated with the vendor’s maintenance routine.
- Scenario: A legacy application or a specific middleware component (e.g., an older version of a Java-based agent or a .NET assembly) is deployed that uses a custom compression library for its configuration files or data blobs, which the YARA rule misidentifies as a packed executable due to similar header structures or entropy patterns.
- Filter/Exclusion: Exclude specific file extensions (e.g.,
.config, .dat, .bin) if the rule is primarily targeting .exe or .dll files, or whitelist the specific hash of the known legitimate legacy binary if it remains unchanged across the environment.
- Scenario: A security team performs a red team exercise or a penetration test where they deploy a custom implant or