UPXInlinerv10byGPcH

Hunt Hypothesis

This hypothesis targets the presence of UPX-packed executables, a common obfuscation technique used by adversaries to compress malware payloads and evade static analysis. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially compromised endpoints or staged payloads that may have been missed by initial signature-based detections due to their packed nature.

YARA Rule

rule UPXInlinerv10byGPcH
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Development teams compiling C/C++ applications using make or cmake with the upx compression tool to reduce binary size for release builds.
  • Filter/Exclusion: Exclude processes where the parent process is make.exe, cmake.exe, or ninja.exe, and the file path matches *\bin\upx.exe or *\tools\upx\upx.exe.
• Scenario: Automated patch management or software deployment agents (e.g., SCCM, Ansible, Puppet) executing custom PowerShell scripts that invoke upx to compress payload executables before distribution to endpoints.
  • Filter/Exclusion: Exclude if the parent process is powershell.exe or pwsh.exe and the command line contains arguments like -Compress or -Optimize, or if the working directory is within a known deployment share (e.g., \\fileserver\deploy\).
• Scenario: CI/CD pipeline agents (e.g., Jenkins, GitLab Runner, Azure DevOps) running build jobs that use upx as part of a post-build step to optimize artifacts for container images or release packages.
  • Filter/Exclusion: Exclude processes spawned by known CI/CD agent binaries (e.g., jenkins-agent.exe, gitlab-runner.exe, vsts-agent.exe) or where the environment variable CI is set to true.
• Scenario: Third-party application installers or updaters (e.g., Java JRE, .NET Framework, or specific vendor tools like VMware Tools) that bundle upx internally to decompress or compress components during installation.
  • Filter/Exclusion: Exclude if the process path resides within a vendor-specific directory (e.g., C:\Program Files\Java\, `C:\