SimplePack111Method2NTbagieTMX

Hunt Hypothesis

This detection identifies processes utilizing the SimplePack111 packing method with the NTbagieTMX signature, which often indicates the execution of obfuscated or packed binaries potentially masking malicious payloads. A proactive hunt is essential in Azure Sentinel to uncover stealthy adversaries who leverage this specific packaging technique to evade standard signature-based defenses and establish persistence within the environment.

YARA Rule

rule SimplePack111Method2NTbagieTMX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SimplePack111Method2NTbagieTMX YARA rule, including suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Real-Time Scanning

  • Context: The MsMpEng.exe process (Microsoft Defender) frequently scans executable payloads in the %TEMP% or AppData\Local\Temp directories. When scanning compressed archives containing specific binary structures, the YARA rule may match the internal signature of the archive itself rather than a malicious payload.
  • Filter/Exclusion: Add an exclusion for the process name MsMpEng.exe and restrict the file path to include only C:\ProgramData\Microsoft\Windows Defender\*. Alternatively, exclude files with the extension .tmp located in user-specific temp folders (%TEMP%).

• Scenario: Scheduled Backup Job via Veeam or Commvault

  • Context: Enterprise backup agents (e.g., VeeamBackupService.exe or CommServeAgent.exe) often create temporary staging files during the “bagie” (packaging) phase of a backup job. These tools utilize proprietary compression methods that mimic the byte patterns detected by the rule, triggering alerts on legitimate backup artifacts in shared network drives.
  • Filter/Exclusion: Create an exclusion based on the parent process VeeamBackupService.exe or CommServeAgent.exe. Additionally, exclude file paths containing keywords like \Backup\Staging\ or specific backup directories (e.g., D:\VeeamBackups\).

• Scenario: Software Deployment via SCCM/Intune

  • Context: During a mass deployment of applications using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the client service (ccmsetup.exe or `Microsoft.Intune.ManagementService