PluginToExev100BoBBobSoft

Hunt Hypothesis

This detection identifies potential malicious activity where a plugin interacts with the ExeV100BobSoft component, suggesting an adversary may be leveraging this specific software interface to establish persistence or execute payloads within the environment. A SOC team should proactively hunt for this behavior in Azure Sentinel to uncover low-severity anomalies that could indicate early-stage compromise attempts often missed by standard alerting thresholds.

YARA Rule

rule PluginToExev100BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 [3] 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 [3] 00 FF D3 83 C4 10 FF 95 B0 40 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PluginToExev100BoBBobSoft detection rule, including suggested filters and exclusions:

• BobSoft Agent Scheduled Self-Update

  • Scenario: The BobSoft endpoint protection agent is configured to run a scheduled task (BobSoft.Update.Scheduler) every morning at 6:00 AM. During this window, the agent’s background service (bobsoft-agent.exe) launches a plugin process that communicates with the Event Viewer (Exev) module to log update telemetry, triggering the YARA rule.
  • Suggested Filter: Exclude events where the parent process is BobSoft.Update.Scheduler and the file path matches C:\Program Files\BobSoft\Agent\Plugins\*.exe.

• IT Admin Deployment via SCCM

  • Scenario: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) to deploy a new BobSoft plugin version across 500 workstations. When the deployment package executes, it invokes the BobSoft.Plugin.Installer which writes configuration data to the Event Viewer service, mimicking the behavior detected by the rule.
  • Suggested Filter: Create an exclusion for processes spawned by ccmexec.exe (SCCM Agent) where the command line contains “InstallPlugin” or the user context is a known system account like DOMAIN\BobSoft-Deploy-Account.

• Database Backup Routine Integration

  • Scenario: The enterprise utilizes BobSoft’s integration module to log backup completion events into the Windows Event Viewer. A nightly SQL Server Agent job triggers the bobsoft-dba-plugin.exe process, which writes a specific XML payload to Exev100, causing the YARA rule to match on legitimate data ingestion rather than malicious activity.
  • Suggested Filter: Exclude detections where the