SDProtector Pro 112 additional

Hunt Hypothesis

This hypothesis targets the presence of SDProtector Pro 112, a commercial software protection tool that adversaries may leverage to obfuscate malicious payloads or hide the true entry point of an executable. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify potentially compromised endpoints where attackers are using known protection mechanisms to evade standard signature-based detection.

YARA Rule

rule SDProtector_Pro_112_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer manually runs the sdprotector.exe binary to test a new build or verify license activation on a staging server.
  • Filter/Exclusion: Exclude processes where the parent process is a development IDE (e.g., code.exe, idea64.exe) or a build tool (e.g., msbuild.exe, dotnet.exe), or restrict the alert to non-development user groups (e.g., exclude users in the DevTeam or QA AD group).
• Scenario: An IT administrator deploys the SDProtector client via a Group Policy Object (GPO) or Configuration Manager (SCCM) task sequence, causing the executable to launch from the C:\Windows\Temp or C:\ProgramData directory during initial setup.
  • Filter/Exclusion: Exclude executions where the parent process is a deployment agent such as ccmexec.exe (SCCM), WmiPrvSE.exe (WMI), or svchost.exe (specifically for GPO processing), or exclude paths under C:\ProgramData\SDProtector and C:\Windows\Temp if the file hash matches the known good version.
• Scenario: A scheduled maintenance job runs a cleanup or re-verification script that invokes sdprotector.exe to check license status or update internal databases, often triggered by Task Scheduler (taskschd.msc) or a service like sdprotector_service.exe.
  • Filter/Exclusion: Exclude processes where the parent is Task Scheduler (taskschd.msc or svchost.exe with the Taskschd service) or the parent process is the SDProtector service itself (sdprotector_service.exe), ensuring only direct user-initiated or unexpected parent-child