Disclosed hacktool set (old stuff) - file asp1.txt

Hunt Hypothesis

This detection identifies adversaries deploying legacy or previously disclosed hacking tools, such as the specific asp1.txt artifact, which may indicate a reconnaissance phase or the reuse of known malware signatures to evade initial defenses. Proactive hunting for these artifacts in Azure Sentinel is critical to uncover dormant threats that leverage outdated toolsets to establish persistence and gather intelligence before executing more advanced attack stages.

YARA Rule

rule aspbackdoor_asp1 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file asp1.txt"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
	strings:
		$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
		$s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
		$s6 = "set rs=conn.execute (sql)%> " fullword ascii
		$s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
		$s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
		$s15 = "sql=\"select * from scjh\" " fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file asp1.txt”, including suggested filters and exclusions:

• Legacy ASP.NET Deployment via IIS Manager

  • Scenario: An administrator performs a routine deployment of an older internal web application using Microsoft IIS Manager or PowerShell. The deployment process extracts the asp1.txt configuration manifest into the C:\inetpub\wwwroot\App_Data directory as part of the standard archive extraction logic, triggering the rule due to the file name and “hacktool” signature classification.
  • Filter/Exclusion: Exclude processes running under the IIS Express or w3wp.exe service accounts where the parent process is iisexpress.exe or powershell.exe, specifically targeting paths containing \App_Data\.

• Scheduled Backup Job for Legacy Reporting Module

  • Scenario: A nightly scheduled task (Task Scheduler) runs a legacy reporting script that archives old log data. The script generates a temporary staging file named asp1.txt in the C:\ProgramData\LegacyReports\Staging folder before compressing it, which matches the detection logic for disclosed hacktools.
  • Filter/Exclusion: Create an exclusion based on the specific scheduled task name (e.g., “Nightly_Legacy_Report_Archive”) and restrict the rule to only trigger if the file is created outside of the defined C:\ProgramData\LegacyReports\ directory tree.

• Third-Party Antivirus Signature Update Service

  • Scenario: The enterprise endpoint protection agent (e.g., CrowdStrike or SentinelOne) performs a background signature update for its “Hacktool” detection module. During this update, the service writes a temporary configuration file named asp1.txt within its own installation directory (`C:\