SoftDefenderV11xRandyLi

Hunt Hypothesis

This detection identifies potential malicious activity associated with the SoftDefenderV11xRandyLi signature, which may indicate an adversary leveraging specific software defense mechanisms or custom tooling to establish a foothold within the environment. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to validate its legitimacy and uncover early-stage threats that might otherwise remain undetected by standard alerting due to its low severity classification.

YARA Rule

rule SoftDefenderV11xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SoftDefenderV11xRandyLi detection rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Intune client service (ccmexec.exe or Microsoft.IntuneManagementService) deploys a new security agent update to endpoints. During the installation, the process extracts temporary files and executes the installer with administrative privileges, triggering the YARA signature due to the specific file structure of the SoftDefender payload.
  • Suggested Filter: Exclude processes where ProcessName matches ccmexec.exe, Microsoft.IntuneManagementService.exe, or msiexec.exe AND CommandLine contains keywords like “SoftDefender”, “Update”, or “Install”.

• Scenario: Scheduled Antivirus Definition Update

  • Context: A nightly scheduled task runs the Symantec Endpoint Protection (SEP) or CrowdStrike Falcon service to download and install new definition signatures. The update engine (Symantec.Definitions.exe or CnsService.exe) unpacks a compressed archive containing SoftDefender components, which mimics the behavior of a potential threat deployment.
  • Suggested Filter: Create an exclusion for scheduled tasks with names containing “AntivirusUpdate” or “DefinitionSync” that run between 01:00 and 05:00 local time, specifically filtering out events where User is SYSTEM.

• Scenario: Enterprise Backup Agent Execution

  • Context: The Veeam Backup & Replication agent (Veeam.Backup.Service.exe) or Acronis Cyber Protect service performs an incremental backup of the user profile directory. During this process, it scans and archives configuration files that include SoftDefender registry keys and