SoftwareCompressv14LITEBGSoftwareProtectTechnologies

Hunt Hypothesis

This detection identifies the presence of specific software compression and protection artifacts associated with legitimate tools like BG Software Protect Technologies, which may be leveraged by adversaries to obfuscate malicious payloads within compressed archives. A proactive hunt is essential in Azure Sentinel to distinguish these benign signatures from potential supply chain attacks or fileless malware that mimic trusted compression utilities to evade initial security controls.

YARA Rule

rule SoftwareCompressv14LITEBGSoftwareProtectTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
	$a1 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SoftwareCompressv14LITEBGSoftwareProtectTechnologies detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Antivirus Database Updates via Background Service

  • Context: The Software Protect Technologies engine (often associated with ESET or similar suites) runs a nightly scheduled task to download and compress new virus definition signatures. This process frequently utilizes the v14LITEBG compression module in the background, triggering the YARA rule even though it is an expected maintenance activity.
  • Filter/Exclusion: Exclude processes running under the service account (e.g., NT SERVICE\SoftwareProtectUpdate) or filter by file path where the executable resides in a known installation directory: C:\Program Files\Software Protect Technologies\bin\*.exe.

• Scenario: Enterprise Backup Agent Performing Incremental Compression

  • Context: During peak business hours, enterprise backup solutions like Veeam Backup & Replication or Rubrik perform incremental backups. These agents often invoke the v14LITEBG compression library to package logs and database snapshots before transmission over the network, mimicking the signature of a standalone software compressor.
  • Filter/Exclusion: Add an exclusion for parent processes known to be backup agents (e.g., VeeamTransportService.exe, rubrik-agent.exe) or exclude events where the process command line contains keywords like --incremental or --backup-mode.

• Scenario: Deployment of Patched Applications via SCCM/Intune

  • Context: When System Center Configuration Manager (SCCM) or Microsoft Intune deploys a new application update to endpoints, the installer often extracts compressed payloads using the SoftwareCompress engine. The background service handles the extraction silently while the user is working