ACProtect14xRISCOsoft

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing RISCOsoft’s ACProtect 14.x to obfuscate malicious executables and evade signature-based detection through advanced packing techniques. A SOC team should proactively hunt for this behavior in Azure Sentinel because identifying these specific protection signatures early allows analysts to prioritize deep inspection of potentially benign processes that may be masking underlying threats or command-and-control activities.

YARA Rule

rule ACProtect14xRISCOsoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the ACProtect14xRISCOsoft detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Deployment of RISOFT Security Suite Updates via SCCM

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM/MECM) to push scheduled updates for the RISOFT security agent. During these deployments, the installer (RISOSoft_Installer.exe) or update service often exhibits ACProtect packing signatures that mimic the rule’s detection logic.
  • Suggested Filter: Exclude processes where ParentProcessName is ccmsetup.exe or wuauserv.exe and the file path contains \Program Files\RISOSoft\.

• Scenario: Scheduled Daily Antivirus Definition Sync Task

  • Context: A Windows Scheduled Task named “RISOFT_Daily_Definition_Sync” runs every morning at 03:00 AM. This task executes a wrapper script that downloads and unpacks definition files, which are often protected by ACProtect to prevent tampering during the download phase.
  • Suggested Filter: Create an exclusion for process names matching RISOSoft_Sync.exe when executed from the specific directory \ProgramData\RISOSoft\Tasks\, limited to the execution window between 02:45 and 03:15 AM.

• Scenario: Admin-Initiated Patch Management via WSUS

  • Context: System administrators manually trigger patch installations for the RISOFT suite using Windows Server Update Services (WSUS). The wsusclient.exe process launches a protected installer component that triggers the YARA rule due to its packed executable structure.
  • Suggested Filter: Exclude events where the UserAccount is part of the “Domain Admins” or