SoftDefenderv10v11

Hunt Hypothesis

This hunt hypothesis targets the execution of specific malware signatures identified by the SoftDefenderv10v11 YARA rule to detect early-stage malicious activity that may not trigger high-severity alerts on its own. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to identify low-fidelity indicators before they escalate, ensuring comprehensive coverage against evolving threats that standard detection rules might overlook due to their low severity classification.

YARA Rule

rule SoftDefenderv10v11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 [4] 58 05 BA 01 [2] 03 C8 74 BE 75 BC E8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SoftDefenderv10v11 detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus Signature Updates via WSUS

  • Context: The Windows Update Service (wuauserv.exe) or a dedicated update agent (e.g., WSUS Offline Update) triggers the SoftDefender service to download and apply new definition signatures during off-hours. This process often involves spawning child processes that match the YARA signature for “SoftDefenderv10v11” installation or configuration changes, mimicking a potential unauthorized software deployment.
  • Filter/Exclusion: Create an exclusion rule in the EDR/SIEM logic to ignore alerts where the parent process is wuauserv.exe and the command line contains keywords like /update, /signature, or specific hash ranges of the SoftDefender updater executable (SoftDefenderUpdate.exe).

• Scenario: Group Policy Object (GPO) Deployment for Endpoint Protection

  • Context: During a standard GPO refresh cycle, the gpupdate command pushes new security configurations to endpoints. This action invokes the SoftDefender service to reconfigure policies or install specific agents on newly joined machines. The YARA rule may flag this automated configuration change as a suspicious “new software installation” event.
  • Filter/Exclusion: Filter alerts where the initiating user account is SYSTEM and the process name matches gpupdate.exe or usoc.dll. Additionally, exclude events occurring within 15 minutes of a scheduled GPO refresh window (e.g., every Tuesday at 02:00 AM).

• Scenario: Patch Management Tool Execution (e.g., SCCM/MECM)

  • Context: Enterprise patch management tools like **Microsoft Endpoint Configuration Manager (SCCM/ME