Upackv035alphaDwing

Hunt Hypothesis

This rule detects the execution of the Dwing malware family, a known Windows trojan that often establishes persistence and enables further post-compromise activities. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify low-severity but potentially impactful threats that may have slipped through initial defenses, ensuring timely containment before the adversary progresses to lateral movement or data exfiltration.

YARA Rule

rule Upackv035alphaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the winget (Windows Package Manager) binary or its associated updater service (winget-updater.exe) during routine software inventory scans or automated patch management cycles. The YARA signature may match the specific versioning string or metadata embedded in the winget executable, which shares naming conventions with the “Dwing” (Dynamic Windows) component.

  • Filter/Exclusion: Exclude processes where the image path is C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_*\winget.exe or C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_*\winget-updater.exe. Additionally, exclude if the parent process is svchost.exe (specifically the AppxSvc or WaaSMedicSvc service host) or Taskeng.exe.

• Scenario: Legitimate execution of the dwing (Dynamic Windows) helper tool by third-party application installers (e.g., Adobe Creative Cloud, Autodesk, or Microsoft Office) that bundle the Dwing framework for dynamic UI rendering or feature toggling. These installers often run in user context during scheduled maintenance windows.

  • Filter/Exclusion: Exclude if the parent process is a known installer binary such as setup.exe, install.exe, or msiexec.exe from trusted vendor directories (e.g., C:\Program Files\Adobe\, C:\Program Files\Autodesk\). Also exclude if the working directory contains temp or tmp and the parent process has a valid digital signature from a major vendor.

• Scenario: Execution of the dwing component by the Microsoft Store background update service or the AppXDeploymentClient during system reboots or user logons. The YARA rule may trigger on the in-memory image or the on-disk DLL (`d