PEiDBundlev102v104BoBBobSoft

Hunt Hypothesis

This detection identifies the execution of specific BobSoft bundled installer binaries that may indicate legitimate software deployment or potential supply chain compromise involving trusted vendors. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to validate their integrity and distinguish between routine administrative activity and stealthy adversary behavior leveraging known good executables.

YARA Rule

rule PEiDBundlev102v104BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 [3] 2E [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the PEiDBundlev102v104BoBBobSoft detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Definition Updates via BobSoft Agent

  • Context: The enterprise utilizes a centralized endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) that leverages the “BobSoft” bundling engine to push daily definition updates. During the scheduled maintenance window (e.g., 02:00 AM), the agent downloads and extracts a new PE bundle containing updated signatures, triggering the rule due to the specific file structure and metadata matching PEiDBundlev102v104.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (BobSoftUpdateService.exe) and the File Path containing \Program Files\BobSoft\Updates\. Additionally, filter alerts where the process parent is the scheduled task runner (svchost.exe or TaskScheduler.exe).

• Scenario: Deployment of Internal Line-of-Business (LOB) Applications via SCCM/Intune

  • Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) to deploy a new internal HR portal client. The installer package is wrapped using the BobSoft bundler technology (v102 or v104). When users install this application during business hours, the extraction of the bundled PE files triggers the detection logic as a “new” suspicious artifact.
  • Suggested Filter/Exclusion: Exclude alerts where the Installation Source matches known SCCM distribution points (e.g., IP range 10.20.x.x) or filter by User Context for specific service accounts used during deployments (e.g., DOMAIN\SCCM-Deploy-SVC).