UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser

Hunt Hypothesis

This detection identifies executable files packed with the UPX utility, a technique frequently employed by adversaries to obscure malicious payloads and evade static signature-based analysis. Proactively hunting for these compressed binaries in Azure Sentinel is essential because UPX-packed executables often serve as initial delivery mechanisms for fileless attacks or advanced persistent threats that may bypass standard antivirus solutions.

YARA Rule

rule UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Based on the rule title UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser, this detection targets executables packed with UPX (Ultimate Packer for Executables), a widely used compression tool often associated with the authors Markus Oberhumer, Laszlo Molnar, and John Reiser. In an enterprise environment, legitimate software frequently utilizes UPX to reduce binary size, which can trigger false positives if the rule assumes all UPX-packed files are suspicious (e.g., potential malware hiding code).

Here are 5 specific scenarios representing legitimate use cases that would trigger this rule, along with suggested filters:

• Scenario: Deployment of Microsoft Office Click-to-Run Updates

  • Context: The Microsoft Office Update Service (OfficeC2RClient.exe or Setup.exe) frequently distributes patches and new features using UPX-packed binaries to minimize download sizes. These files are often executed by the background service during scheduled maintenance windows.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is Microsoft Office Click-to-Run Service (OfficeClickToRun.exe) or Windows Update Agent (usoclient.exe) and the file path contains \Program Files\Microsoft Office Root\.

• Scenario: Execution of Adobe Creative Cloud Background Tasks

  • Context: Adobe Creative Cloud (e.g., Photoshop, Acrobat) utilizes UPX-packed helper executables for background synchronization, license validation, and auto-updates. These often run as scheduled tasks or services initiated by the main CreativeCloud.exe.
  • Suggested Filter/Exclusion: Create an exclusion for any file hash belonging to the “Adobe Creative Cloud” certificate chain where the publisher is “Adobe Inc.” and the process command line contains arguments related to update or sync.