EXECryptorV21Xsoftcompletecom

Hunt Hypothesis

This detection identifies potential file encryption activities associated with the Xsoftcomplete.com domain, which may indicate early-stage ransomware or malicious document processing behaviors. Proactively hunting for this signal in Azure Sentinel allows the SOC team to validate legitimate business processes against emerging threats before they escalate into full-scale data loss incidents.

YARA Rule

rule EXECryptorV21Xsoftcompletecom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
	$a1 = { E9 [4] 66 9C 60 50 8D 88 [4] 8D 90 04 16 [2] 8B DC 8B E1 }

condition:
		$a0 or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the EXECryptorV21Xsoftcompletecom detection rule, along with targeted filters and exclusions:

• Scenario: XSOFT Complete Backup Agent Execution

  • Context: The XSOFT Complete backup agent (xsoftrun.exe or backup_service.exe) runs on scheduled intervals to encrypt and archive user data. Since the rule targets executable behavior associated with “Xsoftcomplete,” legitimate backup operations often trigger the detection when the agent initiates a new encryption job.
  • Filter/Exclusion: Exclude processes where the parent process is xsoftrun.exe or backup_service.exe running from the path C:\Program Files\XSOFT Complete\. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Microsoft Office Document Encryption via Add-in

  • Context: Users frequently utilize the Xsoftcomplete integration add-in within Microsoft Word or Excel to apply enterprise-grade encryption to sensitive documents. When a user saves an encrypted file, the underlying executable invokes the rule’s signature logic, mimicking potential ransomware activity.
  • Filter/Exclusion: Create an exclusion for process trees where the parent is WINWORD.EXE or EXCEL.EXE. Specifically, filter alerts where the command line contains arguments related to “SaveAs” or “EncryptDocument” and the file extension is .docx, .xlsx, or .pdf.

• Scenario: Automated Patch Deployment by SCCM/Intune

  • Context: During enterprise-wide patching cycles, System Center Configuration Manager (SCCM) or Microsoft Intune pushes updates to the Xsoftcomplete client software. The installation or update process involves executing the core binary with elevated privileges, which triggers