UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser

Hunt Hypothesis

This detection identifies executable files packed with the UPX v2.00-v2.90 compressor, a technique frequently employed by adversaries to obscure malicious payloads and evade static analysis. Proactively hunting for these instances in Azure Sentinel is essential because attackers often leverage UPX packing to hide obfuscated malware that may bypass initial signature-based defenses until execution occurs.

YARA Rule

rule UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF D5 8D 87 [4] 80 20 ?? 80 60 [2] 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser detection rule, which identifies executables packed with UPX (Universal Packer) version 2.0.0 to 2.90:

• Scenario: Automated Deployment of Microsoft Office Updates

  • Context: The enterprise utilizes the Microsoft Update Service or Configuration Manager (SCCM/MECM) to push cumulative updates for Office 365 ProPlus. Many of the update installers (setup.exe, odtupdate.exe) are distributed by Microsoft using UPX compression to reduce download size and improve installation speed.
  • Filter/Exclusion: Create a hash-based exclusion or path filter targeting files located in %WINDIR%\Temp\Microsoft Office or specific SCCM distribution points (e.g., C:\ProgramData\Microsoft\Intune\Updates). Additionally, exclude processes where the parent process is ccmsetup.exe or wuauclt.exe.

• Scenario: Execution of Third-Party Antivirus Scanners

  • Context: Security teams frequently deploy on-demand scanning tools such as Malwarebytes for Business, Bitdefender GravityZone, or Kaspersky Endpoint Security. The standalone scanner executables (e.g., mbam.exe, bdagent.exe) often utilize UPX packing by default to minimize memory footprint during runtime scans.
  • Filter/Exclusion: Implement a process name exclusion for known security tools: Malwarebytes*, Bitdefender*, and Kaspersky*. Alternatively, add a filter that excludes alerts where the file path contains \Program Files\Malwarebytes\ or similar vendor-specific directories.

• Scenario: Scheduled Backup and Migration Agents

  • **Context