SoftwareCompressV12BGSoftwareProtectTechnologies

Hunt Hypothesis

This detection identifies the presence of the SoftwareCompressV12BG software protection mechanism, which adversaries may leverage to obfuscate malicious payloads or evade signature-based security controls within Azure Sentinel. Proactively hunting for this indicator allows the SOC team to assess whether its deployment aligns with known legitimate applications or signals a potential attempt by threat actors to mask suspicious activity through compression and encryption techniques.

YARA Rule

rule SoftwareCompressV12BGSoftwareProtectTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SoftwareCompressV12BGSoftwareProtectTechnologies detection rule, along with targeted filtering strategies:

• Scenario: Antivirus Engine Scanning of Compressed Archives

  • Context: The enterprise’s endpoint protection suite (e.g., Microsoft Defender Antivirus or Symantec Endpoint Protection) performs a scheduled scan on large .zip or .7z files stored in the C:\Temp\Backups directory. The YARA rule detects the specific compression signature of these archives as a potential “Software Protect Technologies” artifact, triggering an alert even though it is just a standard file scan operation.
  • Filter/Exclusion: Add a process exclusion for the AV engine’s main scanner process (e.g., MsMpEng.exe or Symantec Client.exe) when accessing paths containing .zip, .7z, or .rar extensions within known backup directories.

• Scenario: Automated Deployment of Application Patches

  • Context: The IT Operations team utilizes Microsoft System Center Configuration Manager (SCCM) to deploy monthly security patches. During the deployment, SCCM extracts a compressed installer package (SoftwareCompressV12 format) into the C:\Windows\CCMCache folder before execution. This extraction process mimics the behavior of the protected software tool, causing the rule to fire on every patch cycle.
  • Filter/Exclusion: Create an exclusion based on the parent process name (ccmsetup.exe or WUAHandler.exe) and restrict the alert scope to exclude file paths under C:\Windows\CCMCache.

• Scenario: Third-Party Backup Agent Execution

  • Context: The organization uses Veeam Backup & Replication agents installed on critical servers. During nightly backup