PluginToExev102BoBBobSoft

Hunt Hypothesis

This rule detects the execution of a specific BobSoft plugin binary, which may indicate an adversary leveraging legitimate software components for initial access or persistence. Proactively hunting for this activity allows the SOC team to identify potential low-and-slow intrusions or supply chain compromises that might otherwise go unnoticed due to the low severity classification.

YARA Rule

rule PluginToExev102BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses Visual Studio Code or JetBrains IntelliJ IDEA with a specific extension (e.g., a C++ compiler plugin or a Java Maven plugin) that spawns a temporary executable to compile code or run unit tests.
  • Filter/Exclusion: Exclude processes where the parent process name is code.exe, idea64.exe, or javaw.exe and the child process path contains \bin\ or \target\ directories.
• Scenario: The Adobe Creative Cloud or Microsoft Office suite updates itself via a background service that drops a temporary .exe file in the %TEMP% or %APPDATA% directories to apply patches, which is then executed by a plugin or helper script.
  • Filter/Exclusion: Exclude executions where the parent process is AdobeUpdateService.exe, OfficeClickToRun.exe, or msiexec.exe and the file path matches C:\Program Files\Adobe\ or C:\Program Files\Microsoft Office\.
• Scenario: A Python or Node.js application uses a package manager like pip or npm to install a package that includes a native binary (e.g., node-gyp compiling a C++ addon), which spawns a temporary compiler executable (cl.exe or gcc.exe) to build the plugin.
  • Filter/Exclusion: Exclude processes where the parent process is python.exe, pip.exe, node.exe, or npm.exe and the child process name is cl.exe, gcc.exe, or g++.exe.
• Scenario: An enterprise Java application (e.g., a legacy ERP system) uses a JNI (Java Native Interface) library that loads a native .dll or .so file, which