SoftProtectSoftProtectbyru

Hunt Hypothesis

This hypothesis targets the presence of SoftProtect, a Russian-origin security tool often associated with specific threat actor tradecraft or legacy endpoint protection, to identify potentially unauthorized or overlooked software installations. Proactively hunting for this YARA signature in Azure Sentinel helps the SOC team uncover hidden endpoints or specific adversary footholds that may be leveraging this tool for persistence or evasion, ensuring comprehensive visibility across the environment.

YARA Rule

rule SoftProtectSoftProtectbyru
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 E3 60 E8 03 [3] D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 [3] 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 [4] 58 E8 [4] 59 83 01 01 80 39 5C }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually installs or updates the SoftProtect client on a workstation using the standard installer executable (SoftProtect.exe or setup.exe) from the vendor’s distribution share.

  • Filter/Exclusion: Exclude processes where the parent process is a known installer (e.g., msiexec.exe, setup.exe, install.exe) or where the image path resides in a standard vendor directory (e.g., C:\Program Files\SoftProtect\, C:\Program Files (x86)\SoftProtect\).

• Scenario: The SoftProtect service (SoftProtectService.exe or similar) is restarted or re-initialized by the Windows Service Control Manager (services.exe) during a routine system reboot or scheduled maintenance window.

  • Filter/Exclusion: Exclude events where the parent process is services.exe and the target process name matches the known SoftProtect service executable name.

• Scenario: A Group Policy Object (GPO) or Configuration Manager (SCCM) task sequence pushes a configuration update or license file to the SoftProtect client, triggering a process launch or file modification event that matches the YARA signature.

  • Filter/Exclusion: Exclude processes spawned by known configuration management agents (e.g., ccmexec.exe, agent.exe from SCCM, or gpmcmt.exe from GPO) or where the command line contains arguments related to configuration, licensing, or policy application (e.g., /config, /license, /update).

• Scenario: A security scanner or endpoint detection and response (EDR) agent performs a real-time scan or on-demand scan of the SoftProtect installation directory, causing the YARA rule to match the binary files on disk during the scan operation.

  • Filter/Exclusion: Exclude file access or process creation events where the parent process is a