Upack PatchDwing

Hunt Hypothesis

This detection identifies adversaries utilizing the “Patch Dwing” technique to unpack and modify executable files, often a precursor to hiding malicious payloads within legitimate applications. Proactively hunting for this behavior in Azure Sentinel is essential to uncover stealthy file integrity manipulations that may evade standard signature-based defenses before they execute critical attack phases.

YARA Rule

rule Upack_PatchDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 3A 00 00 00 02 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Upack PatchDwing detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Deployment of Microsoft System Updates via WSUS/SCCM

  • Context: The Windows Update Standalone Installer (wusa.exe) or Configuration Manager client often extracts compressed .msu packages containing patches. This extraction process involves unpacking binary data that mimics the behavior of a patching tool, triggering the YARA signature.
  • Filter/Exclusion: Create an exclusion for processes running under the C:\Windows\System32\wusa.exe path with the command line argument containing /quiet. Additionally, exclude any process tree initiated by ccmsetup.exe (SCCM) or usoclient.exe.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection run scheduled jobs to download and unpack new definition databases. These updates often involve decompressing large archives that match the “patching” heuristic of the rule.
  • Filter/Exclusion: Exclude processes matching specific vendor executables: C:\Program Files\CrowdStrike\fsq.exe, C:\ProgramData\McAfee\Agent\x86\mfeagent.exe, and C:\Windows\System32\usoclient.exe. Apply a time-based filter to ignore alerts occurring during the defined maintenance window (e.g., 01:00–05:00 local time).

• Scenario: Software Installation via Package Managers (Chocolatey/MSI)

  • Context: IT administrators frequently use Chocolatey or standard MSI installers to deploy enterprise applications. During installation, these tools unpack compressed resources and apply patches to existing binaries,