UPXShitv01500mhz

Hunt Hypothesis

This rule detects the presence of UPX-packed executables, a common technique used by adversaries to compress malware payloads and evade signature-based detection. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially obfuscated binaries that may be staging for execution or persistence, allowing the SOC to investigate low-severity anomalies before they escalate into active compromise.

YARA Rule

rule UPXShitv01500mhz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 [2] 00 [3] 00 [3] 01 [3] 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
	$a1 = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 [2] 00 [3] 00 [7] 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
	$a2 = { E8 [4] 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer manually compresses a custom C++ utility or a small .NET executable using the upx command-line tool to reduce its size before deploying it to a production server or packaging it in a CI/CD pipeline.

  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\builds\, D:\artifacts\) or exclude processes where the parent is a known build tool (e.g., msbuild.exe, dotnet.exe, python.exe) and the file extension is .exe or .dll within a designated “Build Output” folder.

• Scenario: An IT administrator uses a third-party installer or a legacy application that bundles UPX-compressed components (common in older open-source software or specific vendor tools like certain versions of WinRAR, 7-Zip, or custom internal tools) and executes them from a network share or a specific administrative tools folder.

  • Filter/Exclusion: Exclude files executed from known administrative tools directories (e.g., C:\AdminTools\, C:\Program Files (x86)\VendorName\) or exclude if the file path contains keywords like tools, utils, or admin and the file size is below a certain threshold (e.g., < 5MB).

• Scenario: A scheduled task or service runs a small, UPX-compressed helper script or binary (e.g., a custom health check agent, a log rotation script, or a small monitoring daemon) that was previously compressed by the development team to optimize memory usage or disk space.

  • Filter/Exclusion: Exclude if the process is started by a known service host (e.g., svchost.exe, services.exe) or if the file path is within a dedicated services directory (e.g., `