PEiDBundlev100BoBBobSoft

Hunt Hypothesis

This rule targets the execution of BobSoft PEiD, a popular PE file header analyzer, which adversaries often use to inspect binary structures or identify packers during the discovery phase. Proactively hunting for this activity in Azure Sentinel helps identify potential reconnaissance efforts or tooling usage that may precede more complex post-exploitation actions.

YARA Rule

rule PEiDBundlev100BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Bundlers (e.g., Adobe Creative Cloud, Intel Graphics Driver): These installers often use custom PE packers or bundle multiple executables into a single container to streamline deployment. The YARA rule may flag the specific header structure or section names used by these commercial bundlers.
  • Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\Adobe\, C:\Program Files\Intel\) or match against known publisher certificates (e.g., “Adobe Inc.”, “Intel Corporation”) using Windows Authenticode verification.
• Java Application Launchers (e.g., javaw.exe with custom JAR packaging): Many enterprise Java applications (like JBoss, Tomcat, or custom internal tools) use launchers that embed JAR files or native libraries within the PE structure. If the launcher uses a non-standard packing technique or specific section names (e.g., .jardata, .bundle), it may trigger the “bundled” heuristic.
  • Filter/Exclusion: Exclude processes where the parent process is java.exe or javaw.exe and the file path contains bin\ or lib\ directories associated with known Java frameworks. Alternatively, whitelist specific section names like .jardata if they are consistently seen in legitimate Java launchers.
• Game Launchers and Media Players (e.g., Steam, Epic Games Launcher, VLC): These applications frequently bundle plugins, codecs, or update packages directly into the executable to reduce dependency on external DLLs. The PE structure may exhibit characteristics of a bundled file (e.g., large .rsrc sections or specific overlay data) that match the YARA pattern.
  • Filter/Exclusion: Exclude files in known application directories (e.g., C:\Program Files (x86)\Steam\, `C