UPXV194MarkusOberhumerLaszloMolnarJohnReiser

Hunt Hypothesis

This rule identifies executable files packed with the UPX compressor, a technique frequently employed by adversaries to reduce binary size and evade signature-based detection. Proactively hunting for these packed binaries in Azure Sentinel helps uncover stealthy payloads that may be executing on endpoints or within cloud workloads, ensuring that obfuscated malware is not overlooked during routine monitoring.

YARA Rule

rule UPXV194MarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF D5 80 A7 [5] 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of compressed executables within third-party software bundles (e.g., chrome.exe in Google Chrome, code.exe in VS Code, or node.exe in Node.js distributions). Many open-source and commercial applications use UPX to reduce binary size, causing the YARA signature to match the process image or loaded modules.
  • Filter/Exclusion: Exclude processes where the parent process is a known installer or launcher (e.g., msiexec.exe, setup.exe) or where the executable path resides in standard application directories like C:\Program Files\Google\Chrome\ or C:\Users\<User>\AppData\Local\Programs\.
• Scenario: Scheduled maintenance jobs running compressed utility scripts or tools (e.g., 7z.exe in 7-Zip, winrar.exe in WinRAR, or custom PowerShell wrappers that invoke UPX-compressed helper binaries for log rotation or disk cleanup). These are often triggered by Task Scheduler or cron-like services.
  • Filter/Exclusion: Exclude processes initiated by schtasks.exe or taskeng.exe where the command line contains specific keywords like cleanup, compress, or backup, or exclude known utility paths such as C:\Program Files\7-Zip\ or C:\Program Files\WinRAR\.
• Scenario: Development environments where developers run UPX-compressed test binaries or debuggers (e.g., gdb.exe in GDB, lldb.exe in LLDB, or custom C/C++ test harnesses compiled with UPX optimization). This is common in CI/CD pipelines or local dev workstations.
  • Filter/Exclusion: Exclude processes running on accounts with the Developer or CI-Service group membership, or exclude paths containing build, dist, `