SoftComp1xBGSoftPT

Hunt Hypothesis

This rule targets the execution of SoftComp, a known component of the SoftPerfect family of software, which adversaries may leverage for persistence or process injection within Azure environments. Proactively hunting for this activity helps the SOC identify low-severity footholds that could serve as precursors to more complex compromise chains or unauthorized software deployment.

YARA Rule

rule SoftComp1xBGSoftPT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs the bgsoftpt (or similar proprietary soft-compilation) utility locally to generate performance benchmarks or test artifacts before pushing code to the repository.
  • Filter/Exclusion: Exclude processes where the parent process is a known IDE (e.g., code.exe, idea64.exe) or a build tool (e.g., msbuild.exe, gradle.exe) and the command line contains arguments like --benchmark, --test, or --local.
• Scenario: An automated scheduled task runs a nightly maintenance script that invokes bgsoftpt to clean up temporary compilation caches or rotate logs in a specific application directory.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (indicating a Windows Task Scheduler trigger) and the working directory matches the known application path (e.g., C:\Apps\MyService\temp\).
• Scenario: A security team or QA engineer manually executes the tool in a controlled sandbox or isolated VM to validate a new patch or reproduce a bug, often using elevated privileges.
  • Filter/Exclusion: Exclude processes running on accounts with the SecurityTeam or QA group membership, or exclude if the process is launched from a specific test directory (e.g., C:\Temp\QA\) and the user is not a standard domain user.
• Scenario: A third-party application installer or upgrader (e.g., for a specific middleware like WebLogic or Tomcat) calls bgsoftpt as part of its post-install configuration or dependency resolution step.
  • Filter/Exclusion: Exclude if the parent process is a known installer executable (e.g., msiexec.exe, setup.exe, install.exe) and the parent process path resides in