Disclosed hacktool set (old stuff) - file EditKeyLog.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or repurposed hacking tools like EditKeyLog.exe to establish persistence and capture sensitive keystroke data within Azure Sentinel environments. Proactively hunting for this behavior is critical because such “old stuff” often evades signature-based detection, allowing attackers to silently exfiltrate credentials before triggering broader alerts.

YARA Rule

rule EditKeyLog {
	meta:
		description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
	strings:
		$s1 = "Press Any Ke" fullword ascii
		$s2 = "Enter 1 O" fullword ascii
		$s3 = "Bon >0 & <65535L" fullword ascii
		$s4 = "--Choose " fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “Disclosed hacktool set (old stuff) - file EditKeyLog.exe”

• Scenario: Legacy HR Onboarding Automation

  • Context: The Human Resources department utilizes a legacy onboarding script that runs nightly to generate employee ID logs. This script invokes EditKeyLog.exe as part of its dependency chain to record session keys for new hires.
  • Filter/Exclusion: Create an exclusion rule based on the specific parent process name (HR_Onboard_Scheduler.exe) and the full file path C:\Program Files\LegacyHR\Tools\EditKeyLog.exe. Ensure the exclusion applies only when the user context is SYSTEM or a dedicated service account (e.g., svc_hr_automation).

• Scenario: Third-Party Compliance Audit Tool

  • Context: An external compliance vendor deploys an agent that periodically scans workstation registry keys for audit trails. The tool utilizes EditKeyLog.exe to capture and format key-value changes during the “old stuff” maintenance window (typically 2 AM – 4 AM).
  • Filter/Exclusion: Implement a time-based exclusion between 01:30 and 04:30 on weekdays. Additionally, filter by the known vendor’s installation directory path (e.g., C:\ProgramData\ComplianceVendor\Agent\EditKeyLog.exe) to distinguish it from ad-hoc user executions.

• Scenario: Scheduled Group Policy Preference Deployment

  • Context: The IT Operations team uses a scheduled Group Policy task to update local registry keys across the domain. This task triggers EditKeyLog.exe to log configuration changes for reporting purposes, often running under the context of the local administrator during maintenance windows.
  • Filter/Exclusion: Exclude events where the process command line contains specific flags (e.g.,