SkDUndetectablerPro20NoUPXMethodSkD

Hunt Hypothesis

This rule targets the SkD Undetectabler Pro 20 tool, a popular utility used by threat actors to strip debug symbols and remove UPX packing from executables to evade static analysis. Proactively hunting for this behavior helps identify compromised endpoints or staging areas where adversaries are preparing payloads for deployment, allowing the SOC to detect low-severity preparatory actions before they escalate into active intrusions.

YARA Rule

rule SkDUndetectablerPro20NoUPXMethodSkD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom-compiled C/C++ application (e.g., a proprietary internal API gateway or data processor) that was built with a specific compiler version (e.g., MSVC 2019) and linked statically, resulting in a binary structure that matches the “Undetectabler” signature due to its unique section layout or import table ordering, but is not packed with UPX.

  • Filter/Exclusion: Exclude files located in specific development or build artifact directories (e.g., C:\Builds\, C:\Artifacts\, or \\fileserver\dev\bin\) and limit the rule to executable files (*.exe, *.dll) that are not in known development toolchains (e.g., exclude paths containing \vs\, \msbuild\, or \node_modules\).

• Scenario: A legacy line-of-business (LOB) application (e.g., a 15-year-old inventory management system) is updated via a vendor patch that recompiles the core engine without re-packing, causing the binary to match the YARA signature due to a specific sequence of API imports or section headers that the “Undetectabler” rule targets, even though the app is signed by a trusted vendor certificate.

  • Filter/Exclusion: Exclude files with a valid Authenticode signature from known trusted vendors (e.g., VendorName, Inc.) and exclude files in the application’s install directory (e.g., C:\Program Files\LegacyApp\) if the file’s last modified time is within the last 30 days (indicating a recent patch) and the file size is consistent with historical baselines.

• Scenario: A scheduled PowerShell script or a .NET-based utility (e.g., a custom log rotation tool or a database backup agent) is compiled to a native executable using a