UPXProtectorv10x2

Hunt Hypothesis

This detection identifies the execution of binaries packed with UPX version 10.x, a technique often employed by adversaries to obscure malicious payloads and evade static analysis. Proactively hunting for these instances in Azure Sentinel is essential because low-severity alerts may overlook sophisticated threats that leverage UPX compression to hide from traditional signature-based defenses until after initial compromise.

YARA Rule

rule UPXProtectorv10x2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB [5] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the UPXProtectorv10x2 detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Deployment of Patched Security Agents via SCCM/Intune

  • Context: Endpoint Protection platforms (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) often distribute updated agent binaries compressed with UPX to reduce network bandwidth during mass deployments. The UPXProtectorv10x2 rule may flag these legitimate installer packages as suspicious due to the packed executable structure.
  • Filter/Exclusion: Create a whitelist based on the specific file hash (SHA-256) of the known good agent installer or exclude paths containing the deployment folder, such as C:\Program Files\Microsoft Configuration Manager\AdminConsole or C:\Windows\CCM. Additionally, filter by process name if the execution originates from ccmsetup.exe or IntuneManagementExtension.exe.

• Scenario: Execution of Scheduled Backup and Maintenance Scripts

  • Context: Internal IT teams frequently utilize custom PowerShell scripts wrapped in UPX to perform nightly database backups or log rotation. These tools are often distributed as single, packed executables to simplify distribution across non-technical endpoints. When the Windows Task Scheduler triggers these jobs, the rule detects the packed binary execution.
  • Filter/Exclusion: Implement a time-based exclusion for the specific maintenance window (e.g., 02:00–04:00 local time) combined with a path exclusion for the backup directory (e.g., D:\Backup\Scripts\). Alternatively, exclude any process where the parent process is TaskScheduler.exe and the file extension is .exe located within the designated maintenance root.

• Scenario: Distribution of Third-Party Vendor Tools via Group Policy