SimplePackV11XV12XMethod1bagie

Hunt Hypothesis

This detection identifies the execution of SimplePack archives utilizing Method 1 compression, a pattern often leveraged by adversaries to obfuscate malicious payloads within legitimate-looking container formats. Proactively hunting for this behavior in Azure Sentinel is essential to uncover stealthy file-based attacks that may bypass standard signature checks due to their low severity and generic packaging structure.

YARA Rule

rule SimplePackV11XV12XMethod1bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD [4] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SimplePackV11XV12XMethod1bagie detection rule, along with suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Self-Update

  • Context: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) periodically downloads and unpacks update packages using the SimplePack method to apply patches without user intervention. This process often triggers the rule when extracting .appx or .msi payloads containing the specific bagie signature.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for the parent process OfficeClickToRun.exe (Microsoft Corporation) running on port 443, specifically excluding files located in C:\Program Files\Microsoft Office Root\Office16\.

• Scenario: Antivirus Real-Time Scanning of Cached Archives

  • Context: Endpoint protection suites like CrowdStrike Falcon or Microsoft Defender for Endpoint perform real-time scanning on temporary directories. When a user downloads a large archive (e.g., .zip or .7z) containing SimplePack-compliant installers, the AV engine extracts these files to a temp folder (%TEMP%), triggering the YARA rule during the extraction phase before the file is fully committed.
  • Suggested Filter/Exclusion: Exclude the detection logic for any process where the file path contains \AppData\Local\Temp\ or \Windows\Temp\, provided the parent process belongs to a known security vendor (e.g., CrowdStrike.exe, MsMpEng.exe).

• Scenario: Scheduled Group Policy Software Deployment

  • Context: During business hours, System Center Configuration Manager (SCCM) or Microsoft Intune agents execute scheduled deployment jobs. These tools often push SimplePack-based installer packages to endpoints, which