SimplePackV11XMethod2bagie

Hunt Hypothesis

This YARA rule detects the presence of SimplePack, a lightweight .NET packer frequently used by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially compromised workloads or containers that may be executing packed binaries, thereby reducing the time to detect stealthy .NET-based threats before they establish persistence.

YARA Rule

rule SimplePackV11XMethod2bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 }
	$a1 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0 or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses SimplePack to compile a lightweight, self-contained .NET application (e.g., a microservice or CLI tool) for deployment to a staging environment. The resulting executable retains the SimplePack metadata and specific method signatures that trigger the YARA rule.

  • Filter/Exclusion: Exclude files located in known build output directories (e.g., C:\Builds\, D:\Artifacts\) or paths containing bin\Release and bin\Debug. Additionally, consider whitelisting executables with a valid Authenticode signature from the internal development certificate authority.

• Scenario: An IT administrator deploys a custom, internally developed utility (e.g., a disk cleanup script or log rotation tool) written in C# and packed with SimplePack to reduce dependency issues on client machines. The tool is distributed via SCCM or Intune and resides in the Program Files directory.

  • Filter/Exclusion: Exclude files under C:\Program Files\ or C:\Program Files (x86)\ that are owned by a known internal service account or have a specific file version string matching the internal utility name. Alternatively, exclude based on the parent process being a deployment agent like CCMExec.exe or IntuneAgent.exe during the initial write.

• Scenario: A security team or application vendor provides a third-party agent or SDK (e.g., a monitoring agent or API client) that is distributed as a single-file executable packed with SimplePack to simplify installation. The file is placed in a dedicated vendor folder such as C:\Program Files\VendorName\Agent\.

  • Filter/Exclusion: Create a whitelist for specific vendor directories (e.g., C:\Program Files\Datadog\, `C:\Program Files\New