Disclosed hacktool set (old stuff) - file ipclear.vbs

Hunt Hypothesis

This detection identifies adversaries leveraging legacy VBS-based hacktools like ipclear.vbs to establish persistence or manipulate network configurations within Azure Sentinel environments. Proactive hunting for this behavior is critical because older script-based tools often lack modern security controls, making them high-value targets for attackers seeking to exploit unmonitored execution paths and obscure initial access vectors.

YARA Rule

rule aspbackdoor_ipclear {
	meta:
		description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
	strings:
		$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
		$s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
		$s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
		$s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
		$s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file ipclear.vbs detection rule, including suggested filters and exclusions:

• Legacy Network Maintenance Scripts on Domain Controllers

  • Scenario: An older domain controller or network management server runs a nightly scheduled task (Task Scheduler) that executes ipclear.vbs to flush DNS caches and reset network interfaces during off-hours. This script is part of a legacy maintenance routine inherited from a previous infrastructure migration.
  • Filter/Exclusion: Exclude the specific file path (e.g., C:\Scripts\NetworkMaintenance\ipclear.vbs) when executed by the SYSTEM or NT AUTHORITY\NETWORK SERVICE account, specifically during the defined maintenance window (e.g., 02:00–04:00).

• Endpoint Management Tool Deployment (SCCM/Intune)

  • Scenario: A Configuration Manager (SCCM) or Microsoft Intune deployment package pushes a custom VBS script to endpoints to clear IP configurations before applying new network policies. The script is named ipclear.vbs and runs under the context of the SCCM Agent service (ccmexec.exe) or a generic “Software Update” user account.
  • Filter/Exclusion: Create an exclusion based on the parent process name (ccmexec.exe, msedge.exe for Intune, or TaskHost.exe) and restrict it to file hashes that match the known good hash of the enterprise-approved script version.

• Third-Party Backup Agent Pre-Cleanup Routine

  • Scenario: A legacy backup solution (e.g., Veeam or Acronis) utilizes a pre-backup hook script named ipclear.vbs to ensure network stability before initiating large data transfers. The script runs automatically when the backup service