SoftwareCompressBGSoftware

Hunt Hypothesis

This hypothesis targets the presence of compressed software artifacts that may indicate an adversary is obfuscating payloads or staging tools to evade static analysis. Proactively hunting for these patterns in Azure Sentinel helps identify low-severity anomalies that could serve as precursors to more complex post-exploitation activities or persistent backdoors.

YARA Rule

rule SoftwareCompressBGSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy .NET application or Java-based tool uses a background compression library (e.g., bgzip, pigz, or custom C++ compression modules) to archive log files or temporary data during a scheduled nightly maintenance window.

  • Filter/Exclusion: Exclude processes where the parent process is a known scheduler (e.g., Task Scheduler, cron, systemd) or the command line contains specific archive extensions (.gz, .zip, .tar) and the working directory is a standard log or temp path (e.g., C:\Logs, /var/tmp).

• Scenario: An enterprise backup agent (e.g., Veeam, Commvault, or Acronis) spawns a helper process to compress data blocks before uploading them to the backup repository, often running under a dedicated service account with a generic process name that matches the YARA signature.

  • Filter/Exclusion: Exclude processes whose parent executable is a known backup agent binary (e.g., vssadmin.exe, commvault\agent\cv.exe, acronis\agent\agent.exe) or where the process path resides within the vendor’s installation directory.

• Scenario: A developer or IT admin uses a command-line compression tool like 7z (7-Zip) or rar in a background script to compress large source code repositories or database dumps for transfer, where the process name or module hash matches the SoftwareCompressBGSoftware signature.

  • Filter/Exclusion: Exclude if the command line contains explicit compression commands (e.g., 7z a, rar a, zip -r) and the user account belongs to a known developer or IT admin group, or if the process is initiated by a shell interpreter (cmd.exe, powershell.exe, bash.exe).

• Scenario: A CI