SoftDefenderv11xRandyLi

Hunt Hypothesis

This detection identifies potential malicious activity associated with the SoftDefender v11 signature by Randy Li, which may indicate early-stage file-based threats or specific software anomalies within the environment. Proactively hunting for this signal in Azure Sentinel allows the SOC team to validate low-severity alerts before they escalate, ensuring that subtle indicators of compromise are not overlooked during routine monitoring.

YARA Rule

rule SoftDefenderv11xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 [6] 74 1F 75 1D ?? 68 [3] 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 [3] E8 F4 FF FF FF [3] 78 0F 79 0D }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the SoftDefenderv11xRandyLi detection rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Intune agent executes a scheduled task to deploy the latest SoftDefender security updates. This process often involves the SoftDefenderService.exe binary writing configuration files and updating signature databases, which mimics the behavior of a new installation or significant modification detected by the YARA rule.
  • Filter/Exclusion: Create an exclusion for the specific service account used by SCCM (e.g., DOMAIN\SCCM-Deploy-Svc) running on the host where the update is applied. Alternatively, exclude file paths under C:\Program Files\SoftDefender\Updates from the detection scope during business hours (08:00–18:00).

• Scenario: Endpoint Backup Routine by Veeam Agent

  • Context: The Veeam Agent for Microsoft Windows runs a nightly backup job. During the “pre-backup” phase, it scans and locks specific SoftDefender log files (SoftDefender.log, events.db) to ensure data integrity before archiving. This file I/O activity triggers the rule’s logic regarding unexpected access or modification of core security artifacts.
  • Filter/Exclusion: Add a process exclusion for VeeamAgent.exe and VeeamTransportService.exe. Configure the detection to ignore events where the parent process is identified as Veeam services, specifically when accessing files within the SoftDefender installation directory.

• Scenario: Administrative Script Execution by IT Ops Team

  • Context: An administrator (e.g., DOMAIN\RandyLi or a generic `