XPack167

Hunt Hypothesis

This YARA rule targets specific file patterns or memory artifacts associated with the XPack167 signature, potentially indicating the presence of a low-severity malware strain or a known benign tool being leveraged for malicious purposes. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify dormant or low-noise threats that may evade standard behavioral detections, ensuring early visibility into potential footholds within the environment.

YARA Rule

rule XPack167
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Elastic Stack Internal Health Checks: The xp-pack or xp-ack binaries are often executed by the Elastic Agent or Beats to verify license status and cluster health. These processes may briefly appear in memory or on disk with specific version strings that match the YARA pattern.
  • Filter/Exclusion: Exclude processes where the parent process is elastic-agent.exe, filebeat.exe, or metricbeat.exe, or where the command line contains arguments like --healthcheck or --license-check.
• CI/CD Pipeline Artifact Scanning: In DevOps environments, YARA rules are frequently used to scan build artifacts, container images, or dependency jars for known vulnerabilities or proprietary code. The XPack167 rule might be loaded into a scanning tool (like ClamAV, YARA-Native, or a custom Python script) during nightly builds.
  • Filter/Exclusion: Exclude detections occurring in paths associated with CI/CD agents (e.g., C:\jenkins\workspace\, /var/lib/jenkins/, C:\temp\builds\) or where the parent process is a build tool like java.exe, dotnet.exe, or node.exe.
• Security Tooling and EDR Telemetry: Advanced EDR solutions or standalone YARA scanners (e.g., yara.exe, yara64.exe) may load this rule to scan memory or disk for specific Elastic XPack features or known backdoors. This is common during threat hunting exercises or automated memory dumps.
  • Filter/Exclusion: Exclude detections where the parent process is a known security tool (e.g., yara.exe, falco, osqueryd, edr-agent.exe) or where the process name matches common YARA execution binaries.
• Backup and Restore Operations: During