UPXv103v104Modified

Hunt Hypothesis

This detection identifies potentially malicious executables that have been modified by the UPX packer versions 103 and 104, a technique often employed by adversaries to obfuscate code and evade static analysis. Proactively hunting for these signatures in Azure Sentinel is essential because attackers frequently leverage UPX packing to conceal embedded payloads or malicious logic within legitimate-looking applications before they are executed on endpoints.

YARA Rule

rule UPXv103v104Modified
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the UPXv103v104Modified rule, detailing legitimate enterprise activities that trigger the detection and their corresponding exclusion strategies:

• Scenario: Deployment of Microsoft Office Click-to-Run Updates via SCCM/Intune

  • Context: The Microsoft Office update mechanism frequently utilizes UPX (versions 1.03 or 1.04) to compress and package the OfficeClickToRun.exe installer during scheduled maintenance windows. When these updates are applied, the modified executable triggers the YARA rule.
  • Suggested Filter: Create an exclusion based on the specific file path: C:\Program Files\Microsoft Office Root\Office16\OfficeClickToRun.exe. Additionally, exclude processes spawned by the parent process ccmsetup.exe (SCCM) or MsService.exe (Intune).

• Scenario: Execution of Antivirus Definition Updates (e.g., CrowdStrike or Symantec)

  • Context: Major Endpoint Detection and Response (EDR) agents often bundle their definition update modules using UPX compression to reduce network bandwidth usage. The C:\ProgramData\CrowdStrike\csagent.exe or similar components are frequently packed with UPX v1.04, causing a match when the agent performs its routine signature refresh.
  • Suggested Filter: Exclude files located within the vendor’s specific installation directory (e.g., C:\Program Files\CrowdStrike\*) and filter by process name csagent.exe or Symantec Antivirus Console.exe.

• Scenario: Scheduled Backup Job Execution via Veeam or Acronis

  • Context: Enterprise backup solutions often include helper utilities or compression engines packed with UPX to optimize memory usage during heavy I/O operations. When a scheduled nightly backup job initi