UPX20030XMarkusOberhumerLaszloMolnarJohnReiser

Hunt Hypothesis

This hunt detects the presence of executables packed with the UPX utility by identifying specific YARA signatures associated with its core developers, which often indicates an attempt to obscure malicious code or evade static analysis. A SOC team should proactively hunt for these artifacts in Azure Sentinel because attackers frequently leverage UPX compression to conceal payloads and bypass initial security controls that rely on traditional signature-based detection.

YARA Rule

rule UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5E 89 F7 B9 [4] 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D [5] 8B 07 09 C0 74 3C 8B 5F 04 8D [6] 01 F3 50 83 C7 08 FF [5] 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF [5] 09 C0 74 07 89 03 83 C3 04 EB E1 FF [5] 8B AE [4] 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 [4] 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the UPX20030XMarkusOberhumerLaszloMolnarJohnReiser detection rule, which identifies executables packed with UPX (Universal Packer) version 2.0.3+ by Markus Oberhumer and László Molnar:

• Scenario: Deployment of Microsoft Office Click-to-Run Updates

  • Context: The Microsoft Office Click-to-Run update client (OfficeClickToRun.exe) frequently utilizes UPX packing for its background update agents to reduce disk footprint. When the scheduled “Update Office” task runs during business hours, it triggers this rule as a legitimate administrative action.
  • Suggested Filter/Exclusion: Create an exclusion based on the file path C:\Program Files\Microsoft Office\root\Office16\ and process name OfficeClickToRun.exe. Additionally, exclude any file hashes that match known Microsoft-signed UPX binaries in your allowlist.

• Scenario: Execution of Sysinternals Suite Utilities

  • Context: Security teams often distribute tools from the Microsoft Sysinternals suite (e.g., PsExec, ProcessExplorer, or LogFileParser) to endpoints for remote troubleshooting. These utilities are commonly distributed as UPX-packed executables and are frequently run by Domain Admins via scheduled tasks or manual command lines.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is svchost.exe (indicating a service) or powershell.exe, provided the file path contains \Sysinternals\. Alternatively, add an exclusion for files signed by “Microsoft Corporation” with the UPX signature.

• Scenario: Antivirus Engine Updates and Scans

  • Context: Major EDR/Antivirus vendors (such as CrowdStrike Falcon or SentinelOne) often