StarForce Protection Driver Protection Technology

Hunt Hypothesis

This hypothesis targets the presence of StarForce driver protection technology, which adversaries may leverage to maintain persistent low-level access to system resources and protect malicious code from detection. Proactively hunting for this driver in Azure Sentinel helps identify potential supply chain compromises or legacy software dependencies that could serve as a foothold for advanced persistent threats within the environment.

YARA Rule

rule StarForce_Protection_Driver_Protection_Technology: PEiD
{
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Game or Software Installation/Uninstallation:

  • Scenario: An IT administrator or power user installs or uninstalls legacy commercial software (e.g., older versions of Civilization, Diablo, or specific CAD tools) that utilizes StarForce DRM. The driver (sfdrv.sys or similar) is loaded into the kernel during the installation wizard or removed during uninstallation, triggering the YARA rule.
  • Filter/Exclusion: Exclude events where the parent process is msiexec.exe, setup.exe, or uninst.exe and the file path contains \StarForce\ or \SF\. Alternatively, whitelist the specific driver name sfdrv.sys if the organization has confirmed it is only used by known legacy applications.

• Scheduled Maintenance or Patching Jobs:

  • Scenario: A scheduled task (e.g., via Task Scheduler or SCCM) runs a maintenance script for a specific application that includes StarForce protection. The job executes a helper executable that loads the StarForce driver to verify license integrity or apply updates, often occurring during off-hours when noise is higher.
  • Filter/Exclusion: Correlate with the parent process name (e.g., svchost.exe running a specific service, or a custom .exe in a known maintenance folder like C:\ProgramData\CorpMaint\). Exclude if the parent process is a known service host or maintenance tool and the driver load occurs within a defined time window for scheduled jobs.

• Virtual Machine Snapshot or Restore Operations:

  • Scenario: In a virtualized environment (e.g., Hyper-V or VMware), restoring a snapshot of a VM that had StarForce drivers loaded can cause the driver to be re-initialized or re-registered in the guest OS, triggering the detection. This is common in test/dev environments where snapshots are frequently taken and