PEiDBundlev101BoBBobSoft

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific BobSoft bundler signature to deliver potentially malicious payloads through legitimate software distribution channels. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify early-stage supply chain compromises or benign-but-suspicious installations that may serve as a foothold for lateral movement before escalating into critical incidents.

YARA Rule

rule PEiDBundlev101BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PEiDBundlev101BoBBobSoft detection rule, along with targeted filters and exclusions:

• Scenario: Bob Soft Deployment via SCCM/Intune

  • Context: During a scheduled maintenance window, the System Center Configuration Manager (SCCM) or Microsoft Intune agent pushes the “Bob Soft” application bundle to endpoints. The deployment engine extracts the bundled installer (setup.exe or installer.msi) which matches the PEiD signature of the BobSoft vendor before execution begins.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM) or Microsoft.Intune.Management.Service, and the file path contains \AppData\Local\Temp\BobSoft\.

• Scenario: Automated Patching by WSUS

  • Context: The Windows Server Update Services (WSUS) server automatically downloads and installs a security update for the Bob Soft suite. The local update client (usoc.dll or wuauclt.exe) extracts the bundle archive, triggering the YARA rule on the temporary extraction folder containing the bundled PE files.
  • Filter/Exclusion: Create an exclusion for file paths starting with C:\Windows\SoftwareDistribution\Download\ where the parent process is usoc.dll or wuauclt.exe.

• Scenario: Endpoint Protection Scanning

  • Context: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black) performs an on-access scan of a user’s document folder. If the “Bob Soft” application is installed in that directory, the scanner’s heuristic engine may re-scan the bundled executable components, triggering the rule during routine scanning cycles.
  • Filter/Exclusion: