The packer/protector section names/keywords

Hunt Hypothesis

This hunt targets adversaries who utilize custom or obfuscated packers and protectors to mask malicious payloads within legitimate application binaries, often evading signature-based detection by leveraging unique section names and keywords. Proactively hunting for these indicators in Azure Sentinel is critical because low-severity anomalies in binary structures can signal early-stage fileless attacks or supply chain compromises that require deeper behavioral analysis before they escalate into active threats.

YARA Rule

rule suspicious_packer_section : packer PE {

    meta:

        author = "@j0sm1"
        date = "2016/10/21"
        description = "The packer/protector section names/keywords"
        reference = "http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/"
        filetype = "binary"

    strings:

        $s1 = ".aspack" wide ascii
        $s2 = ".adata" wide ascii
        $s3 = "ASPack" wide ascii
        $s4 = ".ASPack" wide ascii
        $s5 = ".ccg" wide ascii
        $s6 = "BitArts" wide ascii
        $s7 = "DAStub" wide ascii
        $s8 = "!EPack" wide ascii
        $s9 = "FSG!" wide ascii
        $s10 = "kkrunchy" wide ascii
        $s11 = ".mackt" wide ascii
        $s12 = ".MaskPE" wide ascii
        $s13 = "MEW" wide ascii
        $s14 = ".MPRESS1" wide ascii
        $s15 = ".MPRESS2" wide ascii
        $s16 = ".neolite" wide ascii
        $s17 = ".neolit" wide ascii
        $s18 = ".nsp1" wide ascii
        $s19 = ".nsp2" wide ascii
        $s20 = ".nsp0" wide ascii
        $s21 = "nsp0" wide ascii
        $s22 = "nsp1" wide ascii
        $s23 = "nsp2" wide ascii
        $s24 = ".packed" wide ascii
        $s25 = "pebundle" wide ascii
        $s26 = "PEBundle" wide ascii
        $s27 = "PEC2TO" wide ascii
        $s28 = "PECompact2" wide ascii
        $s29 = "PEC2" wide ascii
        $s30 = "pec1" wide ascii
        $s31 = "pec2" wide ascii
        $s32 = "PEC2MO" wide ascii
        $s33 = "PELOCKnt" wide ascii
        $s34 = ".perplex" wide ascii
        $s35 = "PESHiELD" wide ascii
        $s36 = ".petite" wide ascii
        $s37 = "ProCrypt" wide ascii
        $s38 = ".RLPack" wide ascii
        $s39 = "RCryptor" wide ascii
        $s40 = ".RPCrypt" wide ascii
        $s41 = ".sforce3" wide ascii
        $s42 = ".spack" wide ascii
        $s43 = ".svkp" wide ascii
        $s44 = "Themida" wide ascii
        $s45 = ".Themida" wide ascii
        $s46 = ".packed" wide ascii
        $s47 = ".Upack" wide ascii
        $s48 = ".ByDwing" wide ascii
        $s49 = "UPX0" wide ascii
        $s50 = "UPX1" wide ascii
        $s51 = "UPX2" wide ascii
        $s52 = ".UPX0" wide ascii
        $s53 = ".UPX1" wide ascii
        $s54 = ".UPX2" wide ascii
        $s55 = ".vmp0" wide ascii
        $s56 = ".vmp1" wide ascii
        $s57 = ".vmp2" wide ascii
        $s58 = "VProtect" wide ascii
        $s59 = "WinLicen" wide ascii
        $s60 = "WWPACK" wide ascii
        $s61 = ".yP" wide ascii
        $s62 = ".y0da" wide ascii
        $s63 = "UPX!" wide ascii

    condition:
        // DOS stub signature                           PE signature
        uint16(0) == 0x5a4d and uint32be(uint32(0x3c)) == 0x50450000 and (
            for any of them : ( $ in (0..1024) )
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 63 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Packer/Protector Section Names/Keywords” detection rule, tailored for a legitimate enterprise environment:

Scenario: Automated Application Deployment via CI/CD Pipeline
- Context: During scheduled nightly builds, the DevOps team uses tools like Jenkins, Azure DevOps, or GitLab CI to package applications. These pipelines often utilize packers such as UPX (Ultimate Packer for Executables) or VMProtect to compress and obfuscate binaries before deploying them to production servers.
- Suggested Filter: Create an exclusion based on the Parent Process Name matching known CI/CD agents (e.g., jenkins-agent.exe, azagent.worker.exe) combined with a specific User Account (e.g., svc-deploy-bot or ci-build-service).
Scenario: Endpoint Protection Software Updates and Scans
- Context: Enterprise EDR solutions like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint frequently download and install updates. These updates often contain packed executables (using keywords like ASPack, Themida, or Enigma) to reduce file size and protect the integrity of the update payload during the installation phase.
- Suggested Filter: Exclude events where the File Path resides within the vendor’s specific installation directory (e.g., C:\Program Files\CrowdStrike\ or C:\Windows\System32\Microsoft Defender) and the process is running under a high-privilege system account (e.g., NT AUTHORITY\SYSTEM).
Scenario: Software Asset Management and Patching Cycles
- Context: IT administrators use centralized management tools like SCCM (Configuration Manager), Ivanti, or **