Disclosed hacktool set (old stuff) - file asp4.txt

Hunt Hypothesis

This detection identifies adversaries deploying legacy or obsolete hacking toolsets, such as the disclosed asp4.txt artifact, which may indicate reconnaissance activities or the use of known, potentially vulnerable utilities within the environment. Proactive hunting for these artifacts in Azure Sentinel is critical to uncover dormant threats that evade standard signature-based defenses and to assess whether these “old” tools represent a deliberate attempt by attackers to blend into existing infrastructure noise.

YARA Rule

rule aspbackdoor_asp4 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file asp4.txt"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
	strings:
		$s0 = "system.dll" fullword ascii
		$s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
		$s3 = "Public Function reboot(atype As Variant)" fullword ascii
		$s4 = "t& = ExitWindowsEx(1, atype)" ascii
		$s5 = "atype=request(\"atype\") " fullword ascii
		$s7 = "AceiveX dll" fullword ascii
		$s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
		$s10 = "sys.reboot(atype)" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file asp4.txt detection rule, including suggested filters and exclusions:

• Scenario: Legacy IIS Web Application Deployment via PowerShell

  • Context: Administrators deploying or updating an older ASP.NET web application often extract archives containing asp4.txt (a legacy configuration or log artifact) to the C:\inetpub\wwwroot directory. The extraction tool (e.g., 7-Zip or WinRAR CLI) triggers a file creation event that matches the rule’s signature for “hacktool” activity involving this specific filename.
  • Suggested Filter/Exclusion: Exclude file creation events where the parent process is powershell.exe or msiexec.exe and the destination path contains \inetpub\wwwroot\. Additionally, filter out events where the file hash matches a known baseline of the legitimate asp4.txt artifact.

• Scenario: Scheduled Maintenance Job for Legacy ERP System

  • Context: A nightly scheduled task (Task Scheduler) runs a custom maintenance script (maintenance_daily.ps1) that generates temporary log files named asp4.txt in the application’s data directory (D:\ERP_Data\Logs). This script is part of an older enterprise resource planning system that has not been fully migrated, causing the rule to flag these routine logs as potential hacktool artifacts.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for file creation events occurring between 01:00 and 04:00 (maintenance window) where the source process is svchost.exe with the service name matching the specific ERP maintenance service, or explicitly exclude the path D:\ERP_Data\Logs\asp4.txt.

• Scenario: Automated Backup and Archiving Routine

  • Context: The enterprise