This hypothesis targets the presence of the Software Compress V12 packer, a tool frequently used by adversaries to obfuscate malicious payloads and evade static analysis during initial access or execution phases. Proactively hunting for this specific compression signature in Azure Sentinel allows the SOC team to identify potentially hidden or disguised executables that may have been deployed via phishing or supply chain attacks before they trigger more advanced behavioral detections.
rule Software_Compress_V12_BG_Software_Protect_Technologies: PEiD
{
strings:
$a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
bg2zip utility (part of the Software Protect Technologies suite) on a jump host or build server.
C:\builds\, C:\temp\, D:\artifacts\) and exclude processes where the parent process is a shell (cmd.exe, powershell.exe) or a build tool (msbuild.exe, dotnet.exe).bg2zip executable to compress daily database backup files before offloading them to the NAS.
svchost.exe (indicating a scheduled task) or powershell.exe and the file path matches known backup locations (e.g., C:\Backups\, \\NAS\Backups\).bg2zip component and executes it during the installation process to unpack or compress configuration files.
Program Files or Program Files (x86) and where the parent process is an installer executable (e.g., setup.exe, install.exe, msiexec.exe).bg2zip tool in a controlled testing environment (e.g., a dedicated lab VM or a specific “tools” share) to validate compression integrity for a new data pipeline.