UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser

Hunt Hypothesis

This detection identifies executable files packed with the UPX utility, a common obfuscation technique used by adversaries to conceal malicious payloads and evade signature-based analysis. The SOC team should proactively hunt for these instances in Azure Sentinel because UPX-packed binaries often indicate early-stage fileless attacks or supply chain compromises that require behavioral inspection beyond standard antivirus scanning.

YARA Rule

rule UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 53 50 C7 03 [4] 90 90 }
	$a1 = { 60 BE [4] 8D BE [4] 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the detection rule UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser, which targets executables packed with UPX (a popular executable packer often used by malware to hide code):

• Scenario: Deployment of Third-Party Security Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, SentinelOne, or Carbon Black, frequently distribute their own updates and auxiliary components wrapped in UPX to reduce disk footprint and improve installation speed. The YARA rule may flag these legitimate agent binaries during scheduled update cycles.
  • Filter/Exclusion: Create a whitelist exclusion for the specific file paths of known security vendors (e.g., C:\Program Files\CrowdStrike\ or C:\SentinelOne\SentinelOne). Additionally, exclude files with digital signatures from these specific Certificate Authorities (CA) to bypass the UPX heuristic check.

• Scenario: Scheduled System Maintenance Scripts

  • Context: Internal IT operations often utilize custom PowerShell scripts or batch utilities (e.g., a DiskCleanup.exe or PatchManager.exe) that are compiled and packed with UPX by internal developers for efficiency. These tools run via Windows Task Scheduler during off-hours, triggering the rule when they execute or update their binaries.
  • Filter/Exclusion: Implement an exclusion based on the process command line arguments containing specific keywords (e.g., --maintenance or --scheduled) and restrict the scope to processes running under the SYSTEM or a dedicated service account like svc-itops.

• Scenario: Distribution of Internal Line-of-Business (LOB) Applications

  • Context: The organization’s internal development team builds lightweight desktop utilities for HR, Finance,