Upack PatchoranyVersionDwing

Hunt Hypothesis

This hypothesis detects adversaries utilizing the “PatchoranyVersionDwing” mechanism to unpack and execute malicious payloads, potentially indicating early-stage file manipulation or obfuscation techniques. A proactive hunt is essential in Azure Sentinel to identify these subtle unpacking activities before they escalate into full-scale compromises, ensuring visibility into low-severity indicators that might otherwise be overlooked by standard alerting thresholds.

YARA Rule

rule Upack_PatchoranyVersionDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 [3] 00 E9 06 02 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Upack PatchoranyVersionDwing detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The OfficeClickToRun.exe service frequently extracts temporary patch files (.msi or .cab) to a staging folder before applying updates. This unpacking activity often triggers the rule when the version string in the payload differs slightly from the installed baseline.
  • Filter/Exclusion: Exclude processes where ProcessName equals OfficeClickToRun.exe and the file path contains \Microsoft Office ClickToRun\. Additionally, filter out events where the parent process is OfficeC2RClient.exe.

• Scenario: Antivirus Engine Real-Time Scanning

  • Context: Endpoint protection suites like CrowdStrike Falcon or SentinelOne often unpack compressed archives (e.g., .zip, .7z) in memory to scan for embedded threats. The detection logic may misinterpret the extraction of a legitimate software installer archive as a suspicious “patching” event by an unknown agent.
  • Filter/Exclusion: Create an exclusion rule based on ParentProcessName containing keywords such as FalconSensor.exe, SentinelOne.exe, or McShield.exe. Ensure the rule ignores events where the FileExtension is .zip or .7z originating from these security tools.

• Scenario: Scheduled System Image Backups (Veeam/Commvault)

  • Context: Enterprise backup agents like Veeam Backup & Replication or Commvault periodically unpack large image files to verify integrity before archiving. The Upack logic detects the extraction of these internal temporary containers as a version patching event, especially when the agent updates its own