yzpack20UsAr

Hunt Hypothesis

This detection identifies potential malicious activity by leveraging a specific YARA signature to scan for known threat patterns within Azure Sentinel’s telemetry data. Proactively hunting for this behavior allows the SOC team to validate the relevance of the yzpack20UsAr rule in their environment and uncover early-stage indicators that may precede more severe security incidents.

YARA Rule

rule yzpack20UsAr
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 25 [4] 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD [4] FF 65 28 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the yzpack20UsAr detection rule, along with recommended filters and exclusions:

• Scenario: Automated deployment of Microsoft Office updates via Microsoft Update Deployment Service (MSUDS) or System Center Configuration Manager (SCCM).

  • Context: The YARA rule likely flags the usar component within the Office update package structure. When SCCM pushes cumulative updates to endpoints, it extracts and executes the yzpack20UsAr payload in the background, mimicking a potential archive unpacking behavior often targeted by malware rules.
  • Filter/Exclusion: Create an exclusion for processes running under the C:\Program Files (x86)\Microsoft Intune Management Extension\ or C:\Windows\System32\smsengine.exe paths with the specific command line argument containing /update. Alternatively, whitelist the file hash of the legitimate Office update installer (setup.exe) when it spawns child processes matching the rule signature.

• Scenario: Scheduled nightly backup jobs executed by Veeam Backup & Replication or Acronis Cyber Protect.

  • Context: During the scheduled window (e.g., 02:00 AM), these tools compress and package large datasets into temporary archives before transmission. The yzpack signature often triggers when the backup agent unpacks metadata or creates a staging archive containing user assets, which the rule interprets as suspicious archive extraction activity.
  • Filter/Exclusion: Apply a time-based filter to suppress alerts for this rule between 01:00 and 05:00 local time on weekdays when backup jobs are active. Additionally, exclude file paths containing \Veeam\Backup\ or \Acronis\Cyber Protect\Agent\ from the scope of this specific YARA rule.