UPX Protector v10x 2

Hunt Hypothesis

This hypothesis targets the presence of UPX-packed executables, a common obfuscation technique used by adversaries to compress malware payloads and evade static analysis. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially malicious or suspicious binaries that may be hiding in memory or on disk, reducing the risk of undetected compromise.

YARA Rule

rule UPX_Protector_v10x_2: PEiD
{
    strings:
        $a = { EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via SCCM/Intune: When deploying older, unmanaged Windows applications (e.g., specific versions of Adobe Acrobat Reader, older Java JREs, or legacy ERP clients) that were compiled with UPX to reduce file size, the binary may match the UPX_Protector_v10x_2 signature.

  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) if the parent process is a known deployment agent like CCMEXEC.EXE (System Center Configuration Manager) or IntuneManagementExtension.exe.

• Third-Party Utility Installation (e.g., 7-Zip, WinRAR, or older PDF tools): Many popular open-source or freeware utilities, particularly older builds of 7-Zip, WinRAR, or specific PDF viewers, use UPX compression for their executables. Installing or updating these tools via a standard installer or direct download can trigger the detection.

  • Filter/Exclusion: Allowlist specific known-good hashes (SHA-256) for these utilities or exclude files in C:\Users\*\AppData\Local\ or C:\ProgramData\ if the parent process is a standard installer like msiexec.exe or setup.exe from a trusted vendor path.

• Scheduled Maintenance Jobs for Legacy Backup/Archive Tools: Some older backup or archive tools (e.g., specific versions of Acronis True Image, older Symantec Backup Exec agents, or custom internal scripts) may have UPX-compressed binaries. When these tools run via Task Scheduler during nightly maintenance windows, the executable is loaded and may be scanned, triggering the rule.

  • Filter/Exclusion: Exclude files if the parent process is `svchost.exe