SimplePack10Xbagie

Hunt Hypothesis

This detection identifies the execution of files packed with the SimplePack10Xbagie compressor, a technique often employed by adversaries to obfuscate malicious payloads and evade signature-based security controls. Proactively hunting for this behavior in Azure Sentinel is essential because low-severity packing events can serve as an early indicator of stealthy fileless attacks or staged compromises that might otherwise be overlooked during routine monitoring.

YARA Rule

rule SimplePack10Xbagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 [2] 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SimplePack10Xbagie detection rule, including recommended filters and exclusions:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: The YARA signature likely matches a common packing algorithm or header used in deployment packages. During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes new application bundles to endpoints. These agents often extract and stage .msi or .appx packages that contain the specific byte sequence triggering SimplePack10Xbagie.
  • Filter/Exclusion: Create a process exclusion for the deployment agents: Microsoft SCCM Client Agent (ccmsetup.exe) and Intune Management Extension (IntuneManagementExtension.exe). Additionally, exclude file paths under standard staging directories like C:\Windows\CCM\Cache or C:\ProgramData\Microsoft\IntuneManagementExtension.

• Scenario: Antivirus Real-Time Scanning of Archive Files

  • Context: Endpoint Detection and Response (EDR) solutions such as CrowdStrike Falcon or Microsoft Defender for Endpoint frequently scan compressed archives (.zip, .7z) in real-time. If the SimplePack10Xbagie rule detects a specific compression signature often found in backup logs or installer archives, it may flag the scanning process itself when it extracts these files into temporary directories.
  • Filter/Exclusion: Exclude the antivirus service processes (e.g., MsMpEng.exe, FalconSensorService.exe) from triggering this rule. Furthermore, add a path exclusion for temporary extraction folders: C:\Users\<User>\AppData\Local\Temp and C:\Windows\Temp.

• Scenario: Scheduled System Backup Jobs (Veeam or Acronis)

  • Context: Enterprise backup