nbuildv10soft

Hunt Hypothesis

This detection identifies the execution of the specific nbuildv10soft process, which is frequently associated with legitimate software installation but can also indicate early-stage adversary activity leveraging known benign tools for initial foothold establishment. SOC teams should proactively hunt for this behavior in Azure Sentinel to validate its context against baseline user activities and distinguish between routine administrative tasks and potential supply chain compromises or living-off-the-land tactics.

YARA Rule

rule nbuildv10soft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 [2] BB [2] C0 [2] 80 [2] 43 E2 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the nbuildv10soft detection rule, along with targeted filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: The enterprise CI/CD pipeline (e.g., Jenkins, GitLab Runner, or Azure DevOps) executes nightly builds on a dedicated build server. During the compilation phase, the nbuildv10soft executable is invoked to generate artifacts for internal applications, triggering the rule due to its process behavior and file creation patterns.
  • Filter/Exclusion: Create an exclusion based on the Process Parent being the CI agent (e.g., jenkins-agent.exe, gitlab-runner.exe) or restrict the detection scope to exclude specific build server hostnames (e.g., build-server-01, ci-node-prod).

• Scenario: Scheduled Software Deployment via Endpoint Management

  • Context: The IT operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons to push a scheduled update package containing the nbuild utility. When the deployment agent runs during business hours, it launches nbuildv10soft as part of the installation script, mimicking a new software build event.
  • Filter/Exclusion: Filter out events where the User Account is a known service account (e.g., NT SERVICE\CCMExec, IvantiAgent) or exclude paths matching the deployment agent’s working directory (e.g., C:\ProgramData\Microsoft\CCM\Logs).

• Scenario: Developer Local Environment Compilation

  • Context: Software engineers on development workstations run local builds using Visual Studio or IntelliJ IDEA. When a developer initiates a “Build Solution” command, the IDE spawns `n