WWPACKv302v302av304Relocationspack

Hunt Hypothesis

This detection identifies potential malicious activity where adversaries utilize specific PE header relocations within the WWPACK v302/v304 family to obfuscate their presence and evade static analysis. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to uncover stealthy fileless or packed threats that may bypass standard signature-based defenses, ensuring early identification of sophisticated evasion techniques before they escalate into critical incidents.

YARA Rule

rule WWPACKv302v302av304Relocationspack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] BF [2] B9 [2] 8C CD 81 ED [2] 8B DD 81 EB [2] 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the WWPACKv302v302av304Relocationspack detection rule, along with targeted filters and exclusions:

• Scenario: Automated deployment of Microsoft Office 365 ProPlus updates via Intune or System Center Configuration Manager (SCCM).

  • Context: The WWPACK signature often matches the relocation logic used by the Office Click-to-Run installer when it reorganizes shared components during a major update cycle.
  • Suggested Filter/Exclusion: Create an exclusion for processes named ClickToRun.exe or OfficeC2RClient.exe running under the SYSTEM account, specifically targeting file paths within C:\Program Files\Microsoft Office\root\Office16.

• Scenario: Execution of Sysinternals Process Monitor (ProcMon) or Process Explorer during administrative troubleshooting sessions.

  • Context: When administrators use these tools to trace application behavior, the underlying DLLs often trigger relocation events that mimic the rule’s signature, especially when analyzing .NET applications.
  • Suggested Filter/Exclusion: Exclude process images containing ProcMon.exe, ProcessExplorer.exe, and their child processes (e.g., dotnet.exe) from the detection logic if the parent process is running under a known Admin user group.

• Scenario: Scheduled nightly execution of Veeam Backup & Replication or Acronis Cyber Protect agents performing file indexing.

  • Context: During backup cycles, these tools frequently relocate metadata and repackage virtual disk images, which generates the specific relocation patterns detected by the YARA rule.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 06