PEiDBundlev102v103DLLBoBBobSoft

Hunt Hypothesis

This detection identifies potentially malicious or suspicious DLL files associated with BobSoft bundler versions 102 and 103 that may indicate supply chain compromises or unauthorized software installations within the environment. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to validate legitimate business applications against known bundler behaviors, reducing the risk of hidden persistence mechanisms introduced through third-party installers.

YARA Rule

rule PEiDBundlev102v103DLLBoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 [4] 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PEiDBundlev102v103DLLBoBBobSoft detection rule, along with recommended filters and exclusions:

• Scenario: Execution of bobsoft.dll during a scheduled Microsoft Office 365 ProPlus update.

  • Context: The BobSoft bundler is often embedded within the Office Deployment Tool (ODT) to manage add-ins or telemetry components during nightly maintenance windows.
  • Filter/Exclusion: Create an exclusion based on the parent process setup.exe (Microsoft Office Setup) running under the system account (NT AUTHORITY\SYSTEM) between 01:00 and 05:00 UTC. Alternatively, whitelist the specific file path: C:\Program Files\Microsoft Office\root\Office16\bobsoft.dll.

• Scenario: Deployment of a third-party endpoint protection agent (e.g., CrowdStrike or SentinelOne) that utilizes BobSoft for hardware fingerprinting.

  • Context: When the EDR agent performs a background inventory scan, it loads PEiDBundlev102v103.dll to verify device identity against the management console.
  • Filter/Exclusion: Exclude alerts where the parent process is csagent.exe (CrowdStrike) or SentinelOne.exe. Add a filter requiring the file hash of the DLL to match the known good SHA256 signature stored in your asset inventory database.

• Scenario: Automated software installation via SCCM (Microsoft Endpoint Configuration Manager) for internal line-of-business applications.

  • Context: During a mass deployment of an internal HR or CRM tool, the installer invokes the BobSoft bundler to package dependencies before the main application launch.
  • Filter/Exclusion: Filter alerts where the command line contains