UPXModifiedStubcFarbrauschConsumerConsulting

Hunt Hypothesis

This detection identifies consumer consulting applications that have been repacked with a modified UPX stub, which often indicates an adversary attempting to obfuscate legitimate binaries or inject malicious payloads through compression techniques. A SOC team should proactively hunt for this behavior in Azure Sentinel because the low severity of such modifications can allow stealthy threats to bypass standard signature-based defenses and evade initial security controls.

YARA Rule

rule UPXModifiedStubcFarbrauschConsumerConsulting
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the UPXModifiedStubcFarbrauschConsumerConsulting detection rule, tailored for an enterprise environment:

• Scenario: Deployment of Compressed Development Tools via SCCM/Intune

  • Context: The IT Operations team frequently deploys development utilities (e.g., Visual Studio Code, Git Bash, or specialized .NET compilers) to engineering workstations. These tools are often packaged with UPX compression to reduce bandwidth usage during distribution, and the stub signature matches the “Farbrausch” profile used by the vendor’s packaging pipeline.
  • Filter/Exclusion: Create a whitelist entry for the specific file hashes of these known executables located in C:\Program Files\ or C:\Windows\System32. Alternatively, exclude files where the parent process is ccmexec.exe (SCCM) or Microsoft.Intune.Agent.exe and the file path contains \Deployment\ or \Apps\.

• Scenario: Execution of Scheduled Backup Agents with UPX Compression

  • Context: Enterprise backup solutions like Veeam Transport Service or Acronis Cyber Protect often utilize UPX-compressed helper binaries to perform incremental scans. During scheduled maintenance windows, these agents spawn child processes that trigger the rule due to their modified stub structure, which mimics the “ConsumerConsulting” signature pattern.
  • Filter/Exclusion: Add an exclusion based on the parent process name VeeamTransport.exe or AcronisCyberProtectService.exe. Additionally, filter out alerts occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these specific backup jobs are known to run.

• Scenario: Installation of Third-Party PDF and Document Processing Suites

  • Context: Departments such as