UPXv103v104

Hunt Hypothesis

This detection identifies executables packed with UPX versions 103 and 104, which adversaries frequently utilize to obscure malicious payloads and evade static analysis by compressing binary structures. A proactive hunt is essential in Azure Sentinel because these specific UPX variants are often employed as a first-stage defense mechanism to conceal initial command-and-control traffic or embedded scripts that may otherwise bypass standard signature-based defenses.

YARA Rule

rule UPXv103v104
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the UPXv103v104 detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise Endpoint Protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection) frequently download and unpack definition updates using UPX-compressed executables. These often trigger the rule during nightly maintenance windows.
  • Filter/Exclusion: Create a path-based exclusion for the specific update folders (e.g., C:\ProgramData\CrowdStrike\fs\bin or C:\Program Files\Microsoft Defender Antivirus\mpclient). Additionally, exclude processes running under the context of known service accounts like NT SERVICE\DefenderSvc.

• Scenario: Deployment of Patched Internal Applications via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune often distributes internal line-of-business applications that are packaged with UPX compression to reduce payload size. When these agents execute the installer on a workstation, the rule flags the unpacked binary.
  • Filter/Exclusion: Implement an exclusion based on the Process Name and Publisher. Filter out events where the publisher is “Microsoft Corporation” or your internal IT department’s specific certificate thumbprint (e.g., CN=Internal-App-Distribution).

• Scenario: Execution of Third-Party Backup Agents

  • Context: Enterprise backup solutions such as Veeam Agent for Windows, Acronis Cyber Protect, or Rubrik utilize UPX-compressed helper processes to perform incremental scans and data transfers. These background jobs run continuously and generate high-volume alerts.
  • Filter/Exclusion: Add a