Disclosed hacktool set (old stuff) - file EDIR.ASP

Hunt Hypothesis

This detection identifies adversaries deploying legacy hacking tools within the Azure environment by monitoring for the specific execution or presence of the EDIR.ASP file artifact. Proactive hunting is essential to uncover dormant threats that may have been overlooked by standard rule sets, ensuring that outdated tooling does not serve as a persistent entry point for lateral movement or data exfiltration attacks.

YARA Rule

rule aspbackdoor_EDIR {
	meta:
		description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
	strings:
		$s1 = "response.write \"<a href='index.asp'>" fullword ascii
		$s3 = "if Request.Cookies(\"password\")=\"" ascii
		$s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
		$s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
		$s19 = "whichdir=Request(\"path\")" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file EDIR.ASP detection rule, including suggested filters and exclusions:

• Scenario: Legacy Exchange Directory Reporting Script Execution

  • Context: The EDIR.ASP file is a legacy Active Directory reporting component often hosted on IIS within the Exchange environment. During end-of-month audits, the Exchange Service Account (EXCHANGE\svc_audit) executes this script to generate user provisioning reports.
  • Suggested Filter/Exclusion: Create an exclusion rule that ignores alerts where the Process Name is w3wp.exe (IIS Worker Process) and the User Account matches known Exchange service accounts (e.g., EXCHANGE\svc_audit, DOMAIN\ExchangeAdmin). Additionally, filter by file path if the script resides in a dedicated legacy directory like C:\Program Files\Microsoft\Exchange Server\v15\Reporting.

• Scenario: Scheduled Directory Cleanup Job via PowerShell

  • Context: A nightly scheduled task named “AD_Health_Check” runs on domain controllers to clean up old Active Directory objects. This job invokes a custom PowerShell wrapper that calls the EDIR.ASP utility to validate directory integrity before archiving logs.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or svchost.exe (specifically the “Task Scheduler” service) and the execution occurs during a defined maintenance window (e.g., 02:00 – 04:00 UTC). Implement a logic check to suppress alerts if the file hash of EDIR.ASP matches a known good baseline stored in your asset inventory.

• Scenario: Third-Party Identity Management Tool Integration

  • Context: The enterprise uses an older version