← Back to SOC feed Coverage →

Disclosed hacktool set (old stuff) - file ArtTray.exe

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-30T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or disclosed hacking tools like ArtTray.exe to establish persistence and execute reconnaissance activities within the environment. A proactive search in Azure Sentinel is essential because attackers often repurpose known utilities with modified hashes to evade signature-based detection while maintaining access for lateral movement.

YARA Rule

rule ArtTray_zip_Folder_ArtTray {
	meta:
		description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
	strings:
		$s0 = "http://www.brigsoft.com" fullword wide
		$s2 = "ArtTrayHookDll.dll" fullword ascii
		$s3 = "ArtTray Version 1.0 " fullword wide
		$s16 = "TRM_HOOKCALLBACK" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file ArtTray.exe detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar