STProtectorV15SilentSoftware

Hunt Hypothesis

This detection identifies silent software installations by STProtector V15, a behavior often indicative of adversaries establishing persistence or deploying custom tools without triggering standard user notifications. Proactively hunting for this activity in Azure Sentinel allows the SOC team to uncover stealthy initial access or lateral movement attempts that might otherwise remain invisible due to their non-intrusive nature.

YARA Rule

rule STProtectorV15SilentSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the STProtectorV15SilentSoftware detection rule, including targeted filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Silent Updates

  • Context: The OfficeClickToRun.exe process often executes a silent update mechanism that mimics the behavior of STProtector’s installation logic. This frequently occurs during off-hours or when users launch an Office application for the first time after a patch cycle.
  • Filter/Exclusion: Exclude processes where the executable path contains C:\Program Files\Microsoft Office Root\Office16 and the command line arguments include /quiet or update.

• Scenario: SCCM (ConfigMgr) Application Deployment

  • Context: System Center Configuration Manager (SCCM) often deploys enterprise software packages using silent installers. When deploying a new tool or patch, the ccmsetup.exe or installutil.exe process invokes the STProtector signature logic to ensure compliance before installation.
  • Filter/Exclusion: Create an exclusion for parent processes named ccmexec.exe or wuauserv.exe (Windows Update) that are running under the context of a scheduled task with names containing “SoftwareUpdate” or “AppDeployment”.

• Scenario: Antivirus Real-Time Protection Scanning

  • Context: Third-party endpoint protection suites like CrowdStrike Falcon or Symantec Endpoint Protection often trigger silent background scans on newly downloaded executables. These scanners may invoke a verification routine that matches the STProtectorV15 signature, particularly when scanning files in the AppData\Local\Temp directory.
  • Filter/Exclusion: Filter out alerts where the file path is located within %TEMP% directories and the process image hash matches known signatures for CrowdStrike (`csf