Upack022023betaDwing

Hunt Hypothesis

This detection identifies the execution of unpacked or decompressed payloads matching the “Upack022023betaDwing” signature, which often indicates adversaries employing obfuscation techniques to hide malicious code within legitimate archives. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to uncover stealthy initial access attempts that may bypass standard static analysis by revealing hidden components before they fully execute on endpoints.

YARA Rule

rule Upack022023betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
	$a1 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
	$a2 = { AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

condition:
		$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Upack022023betaDwing detection rule, including suggested filters and exclusions:

• Scenario: Antivirus Engine Real-Time Scanning of Compressed Archives

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon frequently trigger this rule when the real-time protection engine scans large .zip, .7z, or .tar files in user download folders. The YARA signature may misinterpret the internal structure of these archives as a packing mechanism used by the Dwing malware family.
  • Filter/Exclusion: Add an exclusion for processes named MsMpEng.exe (Microsoft Defender) and C-Drive\Program Files\CrowdStrike\FalconSensor\csfalcon64.exe. Configure the rule to ignore alerts where the parent process is one of these AV agents.

• Scenario: Scheduled Backup Job Processing Compressed Data

  • Context: A nightly scheduled task using Veeam Backup & Replication or Acronis Cyber Protect extracts and processes compressed backup containers (.vbk or .acb files) on the file server. The extraction process involves unpacking nested archives, which matches the “Upack” logic of the YARA rule.
  • Filter/Exclusion: Create a time-based exclusion for the hours between 02:00 and 06:00 (local server time) specifically for file paths under D:\BackupData\ or E:\VeeamRepository. Alternatively, exclude process names vbrservice.exe and AcronisAgentService.exe.

• Scenario: Software Deployment via SCCM/Intune Unpacking

  • Context: During a mass software deployment using Microsoft Endpoint Configuration Manager (SCCM) or