RLPackv118BasicDLLaPLibAp0x

Hunt Hypothesis

This YARA rule targets a specific variant of the RLPack v1.18 basic DLL, a lightweight packer often used by threat actors to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially compromised hosts or staging environments where adversaries are deploying packed binaries to hide their code execution logic.

YARA Rule

rule RLPackv118BasicDLLaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the RLPack utility (a legitimate resource packer) by a DevOps engineer or build server during the compilation of custom internal applications or third-party libraries that require resource compression.
  • Filter/Exclusion: Exclude files located in standard build directories (e.g., C:\Builds\, D:\CI\) or exclude processes initiated by known build agents (e.g., jenkins.exe, teamcity.exe, azureagent.exe).
• Scenario: A scheduled maintenance job runs a custom script that uses RLPack to compress large log archives or configuration bundles before transferring them to a backup server.
  • Filter/Exclusion: Exclude executions where the parent process is a scheduled task runner (e.g., schtasks.exe, TaskScheduler.exe) and the working directory is a designated data archive folder (e.g., C:\Archives\, E:\Backups\).
• Scenario: An IT administrator manually runs RLPack from a network share or USB drive to compress a large set of user profile data or application installers for distribution.
  • Filter/Exclusion: Exclude executions where the image path originates from a known administrative network share (e.g., \\fileserver\tools\) or from a mapped drive letter associated with admin tools (e.g., Z:\Tools\).
• Scenario: A software installer for a legacy enterprise application includes RLPack as a helper utility to decompress resources during the installation process.
  • Filter/Exclusion: Exclude executions where the parent process is a known installer executable (e.g., msiexec.exe, setup.exe, install.exe) and the file path is within the application’s temporary installation directory (e.g., C:\Windows\Temp\, `C:\Program Files\Temp\