This detection identifies adversaries attempting to execute or stage malicious payloads by unpacking compressed archives using specific Dwing-based mechanisms, which often serve as an initial foothold for fileless attacks or obfuscated malware delivery. A proactive hunt is essential in Azure Sentinel to uncover these low-severity but high-impact activities that may bypass traditional signature-based defenses and indicate early-stage lateral movement or data exfiltration preparation.
rule UpackV010V011Dwing
{
meta:
author="malware-lu"
strings:
$a0 = { BE [4] AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D [6] B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the UpackV010V011Dwing YARA rule, tailored for a legitimate enterprise environment:
Software Deployment via SCCM/Intune: The rule triggers when System Center Configuration Manager (SCCM) or Microsoft Intune deploys new applications containing embedded archives. These deployments often extract compressed installers (e.g., .msi or .cab files) that match the “Upack” signature logic, mimicking the behavior of unpacking malware payloads.
ccmsetup.exe, Microsoft.Win32.SystemEvents, or IntuneManagementExtension where the parent process is a known management service account (e.g., NT SERVICE\CCM).Antivirus Real-Time Scanning of Downloaded Archives: Endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently scan and unpack user-downloaded .zip, .7z, or .rar files in real-time. The YARA rule may flag the extraction activity performed by these AV engines as a potential malicious unpacking event rather than routine scanning.
MsMpEng.exe, FalconSensorService.exe, and rtvscan64.exe when they are operating in “Real-Time Scan” mode on the C:\Users\*\Downloads directory path.Scheduled Backup and Archiving Jobs: Enterprise backup solutions such as Veeam, Commvault, or Acronis Cyber Protect often run scheduled jobs that compress and decompress large data sets for incremental backups. These jobs utilize internal unpacking libraries that generate file structures identical to those detected by the UpackV010 rule.