Disclosed hacktool set (old stuff) - file asp3.txt

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying legacy or obfuscated hacking tools, such as the identified “asp3.txt” artifact, which may indicate a persistent threat actor utilizing outdated reconnaissance utilities to maintain access within the environment. Proactively hunting for these disclosed hacktool sets in Azure Sentinel is critical to uncover dormant threats that evade standard signature-based detection and could serve as a foothold for lateral movement or data exfiltration campaigns.

YARA Rule

rule aspbackdoor_asp3 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file asp3.txt"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
	strings:
		$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
		$s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
		$s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
		$s14 = " Windows NT " fullword ascii
		$s16 = " WIndows 2000 " fullword ascii
		$s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
		$s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
		$s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file asp3.txt”, including targeted filters and exclusions:

• Legacy IIS Reporting Module Execution

  • Scenario: The web server team runs a nightly report generation script on an older Windows Server 2016 instance. This legacy module uses a custom asp3.txt configuration file to define parameters for the “ASP.NET Legacy Report Tool,” which is frequently accessed by the IIS worker process (w3wp.exe) during scheduled maintenance windows.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the parent process is w3wp.exe and the file path resides within the specific directory C:\inetpub\reports\legacy\.

• Automated Backup Verification Job

  • Scenario: The enterprise backup solution (e.g., Veeam or Commvault) performs a daily integrity check on archived web application data. As part of this verification, the backup agent reads an asp3.txt manifest file located in the shared network drive to validate checksums before archiving old logs.
  • Filter/Exclusion: Exclude alerts triggered by known backup service accounts (e.g., DOMAIN\svc_backup_agent) accessing files with the extension .txt within the \\FileServer\BackupData\WebApps\ share.

• Third-Party Compliance Scanner Activity

  • Scenario: An external compliance tool (such as Qualys or Tenable) runs a weekly vulnerability scan against the internal web farm. The scanner probes specific legacy endpoints and generates an asp3.txt temporary log file to record HTTP response codes for deprecated ASP pages during the assessment phase.
  • Filter/Exclusion: Implement a filter that suppresses alerts when the user context is identified as the “Compliance