Soft Defender v112 additional

Hunt Hypothesis

This hypothesis targets the presence of the Soft_Defender v112 variant, a tool often leveraged by adversaries for endpoint defense evasion or specific network-based threat operations. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised endpoints or active threat actor tooling before it escalates into more complex post-exploitation activities.

YARA Rule

rule Soft_Defender_v112_additional: PEiD
{
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Antivirus/EDR Self-Update or Component Installation: Legitimate endpoint protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) may install or update specific driver components or service binaries that share similar structural characteristics or import tables with the Soft_Defender_v112 variant.
  • Filter: Exclude processes where the parent process is the primary EDR agent (e.g., FalconSensor.exe, MsMpEng.exe, SentinelOne.exe) or where the file path resides in the vendor’s specific installation directory (e.g., C:\Program Files\CrowdStrike\).
• Third-Party Backup or Snapshot Tools: Enterprise backup solutions like Veeam, Commvault, or Acronis often utilize low-level disk access or memory snapshotting features that can mimic the behavioral footprint of endpoint defense tools, particularly when interacting with system memory or protected processes.
  • Filter: Exclude alerts where the triggering process belongs to known backup suites (e.g., VeeamBackup.exe, commvault.exe) or is running under a service account associated with backup infrastructure.
• Legacy Application Compatibility Shims: Older enterprise applications (e.g., legacy ERP systems, specialized CAD software, or financial trading platforms) may use compatibility shims or custom DLLs to maintain stability on modern OS versions. These shims can sometimes load into memory in a way that triggers YARA signatures designed to catch obfuscated or protected endpoint agents.
  • Filter: Exclude processes from known legacy application directories (e.g., C:\Program Files (x86)\LegacyERP\) or where the module is loaded by a specific, whitelisted application executable (e.g., LegacyApp.exe).
• Scheduled Maintenance or Patching Jobs: Automated patch management tools (e.g., SCCM, WSUS, or Ansible)