UPXProtectorv10x

Hunt Hypothesis

This hunt detects the execution of binaries packed with the UPX v10x protector, a technique often used by adversaries to obscure malicious payloads and evade static analysis. Proactively hunting for this behavior in Azure Sentinel is essential because low-severity detections can serve as early indicators of fileless attacks or supply chain compromises that might otherwise be overlooked during routine monitoring.

YARA Rule

rule UPXProtectorv10x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB EC [4] 8A 06 46 88 07 47 01 DB 75 07 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the UPXProtectorv10x detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated deployment of third-party security agents (e.g., CrowdStrike Falcon or Carbon Black) via SCCM/Intune.

  • Context: The installer packages for these agents often utilize UPX compression to reduce download size during mass rollout. When the agent service starts post-installation, it triggers the rule on the compressed executable.
  • Filter/Exclusion: Create an exclusion based on the specific file hash or path of known good installers (e.g., C:\Program Files\CrowdStrike\csagent.exe where the UPX signature matches the vendor’s official build). Alternatively, exclude processes spawned by ccmsetup.exe or msiexec.exe when they launch these specific agents.

• Scenario: Execution of internal administrative PowerShell scripts packaged with UPX.

  • Context: The IT Operations team frequently distributes custom management tools (e.g., “PatchManager_v2.exe”) that are compiled and compressed using UPX to ensure quick execution across 5,000+ endpoints. These tools run daily during maintenance windows.
  • Filter/Exclusion: Implement a whitelist based on the file’s digital signature publisher. If the executable is signed by “Internal-IT-Ops” and contains the specific UPX v10.x header, suppress the alert. Additionally, exclude any process where the parent process is powershell.exe running under the context of a scheduled task named “Daily_Patch_Routine”.

• Scenario: Scheduled backup agents (e.g., Veeam or Acronis) performing incremental backups.

  • Context: Backup software often uses UPX-compressed helper binaries to handle file indexing and metadata extraction before archiving data