SoftDefender1xRandyLi

Hunt Hypothesis

This detection identifies potential malware or suspicious software artifacts matching the “SoftDefender1xRandyLi” signature, which may indicate early-stage compromise or unauthorized application deployment within the environment. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to validate its legitimacy and mitigate low-severity threats before they escalate into broader incidents.

YARA Rule

rule SoftDefender1xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: SoftDefender1xRandyLi

• Scenario 1: Automated Endpoint Protection Updates

  • Context: The YARA rule detects the signature of SoftDefender executables running with elevated privileges. In a standard enterprise environment, the daily scheduled update job for CrowdStrike Falcon or Microsoft Defender for Endpoint often triggers this detection when the agent service (CrdSvc.exe or MsMpEng.exe) launches to download and apply new definition signatures during off-hours (e.g., 2:00 AM).
  • Suggested Filter: Exclude processes where the parent process is the update orchestrator (e.g., wuauserv.exe for Windows Update or falcon.sysmon service) and the file path matches the known installation directory of the EDR solution.

• Scenario 2: Admin-Driven Patch Deployment via SCCM/Intune

  • Context: During a scheduled maintenance window, an administrator uses Microsoft System Center Configuration Manager (SCCM) or Microsoft Intune to push a critical security patch. The deployment agent executes the SoftDefender installer or configuration script on thousands of endpoints simultaneously, triggering the rule due to the high volume of process creation and registry modifications associated with the installation routine.
  • Suggested Filter: Create an exclusion based on the user context; filter out alerts where the running user is a known service account (e.g., DOMAIN\SCCM-Service-Account) or a specific admin group, provided the execution occurs within the defined maintenance window (e.g., 01:00–05:00).

• Scenario 3: Backup and Recovery Software Scans

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Acronis Cyber Protect