UpxLock1012CyberDoomTeamXBoBBobSoft

Hunt Hypothesis

This detection identifies potential malware execution utilizing UPX packing signatures associated with the CyberDoom Team X and BobSoft families, which often employ compression to evade static analysis. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that may bypass initial signature-based defenses by analyzing file entropy and process lineage before they establish persistence or initiate lateral movement.

YARA Rule

rule UpxLock1012CyberDoomTeamXBoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the UpxLock1012CyberDoomTeamXBoBBobSoft detection rule, including suggested filters and exclusions:

• Scenario: Legitimate deployment of software updates via Microsoft Endpoint Configuration Manager (MECM/SCCM) where the client agent downloads a UPX-packed installer package.

  • Filter/Exclusion: Create an exclusion for processes running under the CcmExec.exe or Wuauserv.exe service accounts, specifically filtering file paths containing \Program Files\Microsoft Configuration Manager\AdminConsole\.

• Scenario: Scheduled nightly backup jobs executed by Veeam Backup & Replication which utilize a UPX-compressed utility to compress and encrypt log files before archiving.

  • Filter/Exclusion: Exclude the process vbr.exe (Veeam Backup Service) when the file hash matches known Veeam signature versions, or filter based on the scheduled task name \Microsoft\Veeam\Backup\DailyCompression.

• Scenario: Automated patching workflows triggered by Ansible Tower or Jenkins CI/CD pipelines that deploy custom agent scripts packaged with UPX compression to reduce transfer size.

  • Filter/Exclusion: Add a whitelist for the ansible-runner.exe and jenkins-agent.jar processes, specifically excluding events where the parent process is identified as java.exe or python.exe running from the \Jenkins\workspace\ directory.

• Scenario: Execution of legitimate third-party endpoint protection tools (e.g., CrowdStrike Falcon or Carbon Black) that internally use UPX-packed modules for their real-time scanning engines.

  • Filter/Exclusion: Implement a rule exclusion based on the file path prefix \Program Files\CrowdStrike\ or `\Program Files\