Disclosed hacktool set (old stuff) - file entice.asp

Hunt Hypothesis

This detection rule identifies the presence of a legacy hacking tool named “entice.asp,” which adversaries may deploy to establish persistence or execute reconnaissance within the environment. A proactive hunt is essential in Azure Sentinel because this specific artifact represents an outdated component that could indicate a dormant threat or a lateral movement attempt leveraging known, yet potentially overlooked, attack vectors.

YARA Rule

rule aspbackdoor_entice {
	meta:
		description = "Disclosed hacktool set (old stuff) - file entice.asp"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
	strings:
		$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
		$s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
		$s4 = "conndb.Execute(sqllanguage)" fullword ascii
		$s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
		$s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file entice.asp detection rule, including suggested filters and exclusions:

• Legacy HR Portal Maintenance Script

  • Scenario: The internal Human Resources department runs a nightly scheduled job using entice.asp to sync employee data from an on-premise SQL database to the legacy intranet portal. This script is hosted in the C:\Intranet\HR\Scripts directory and executes via IIS Application Pool under the NT SERVICE\IIS APPPOOL\HR-Portal account.
  • Filter/Exclusion: Create a rule exclusion based on the file path C:\Intranet\HR\Scripts\entice.asp AND process name w3wp.exe. Additionally, exclude events where the parent process is svchost.exe running under the specific IIS AppPool identity.

• Quarterly Compliance Reporting Tool

  • Scenario: The Finance team utilizes a custom reporting tool named “Entice Report Generator” which relies on an older .asp architecture to generate quarterly compliance PDFs. This tool is launched manually by the Finance-Admin group via a shortcut that invokes entice.asp located in C:\Program Files\ComplianceTools\Reports.
  • Filter/Exclusion: Exclude detections where the file path matches C:\Program Files\ComplianceTools\Reports\entice.asp AND the user context belongs to the Finance-Admin security group.

• Automated Asset Inventory Scan

  • Scenario: The IT Operations team deploys a scheduled task named “Asset_Inventory_Daily” that executes every morning at 06:00 AM. This task invokes a legacy web-based scanner (entice.asp) to query hardware inventory from the network management server