UPX290LZMADelphistubMarkusOberhumerLaszloMolnarJohnReiser

Hunt Hypothesis

This hunt targets the presence of Delphi-based executables packed with UPX compression, a technique frequently employed by malware authors to obscure code analysis and evade signature-based detection. A proactive search in Azure Sentinel is essential because these packed binaries often indicate early-stage adversary activity or obfuscated tools that may bypass standard static scans until they are unpacked during runtime execution.

YARA Rule

rule UPX290LZMADelphistubMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] C7 87 [8] 57 83 CD FF 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the UPX290LZMADelphistubMarkusOberhumerLaszloMolnarJohnReiser detection rule, along with recommended filters and exclusions:

• Scenario: Deployment of legacy Delphi-based internal applications (e.g., custom HR or inventory tools) that utilize the UPX packer to reduce executable size.

  • Filter/Exclusion: Create a whitelist for specific file paths where these known applications reside, such as C:\Program Files\InternalApps\HRModule\*.exe, and exclude files with a known SHA-256 hash signature verified by the application team.

• Scenario: Execution of third-party diagnostic or utility tools (e.g., Microsoft Sysinternals Process Explorer or Nmap) that are frequently distributed as UPX-packed executables for portability.

  • Filter/Exclusion: Add an exclusion rule based on the publisher certificate, specifically filtering out files signed by “Markus Oberhumer” or “LZMA SDK” where the file path contains C:\Tools\ or C:\Windows\System32\.

• Scenario: Scheduled maintenance jobs running automated scripts that invoke UPX-packed command-line utilities (e.g., 7-Zip or specific backup agents) during off-hours.

  • Filter/Exclusion: Implement a time-based exclusion for the rule between 01:00 and 05:00 UTC, combined with a process parent filter to only alert if the UPX executable is spawned by Task Scheduler (svchost.exe or taskscheduler.exe) rather than user interaction.

• Scenario: Installation of software patches for development environments where IDEs (like Eclipse or IntelliJ) include bundled, packed helper tools using the Delphi stub