This detection identifies adversaries deploying legacy hacking tools that utilize a specific ReadMe text file to establish persistence or signal command-and-control activity within the environment. Proactively hunting for this artifact in Azure Sentinel is critical because older toolsets often lack modern security signatures, making them high-value targets for attackers seeking to exploit unmonitored or overlooked infrastructure components.
rule EditKeyLogReadMe {
meta:
description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
author = "Florian Roth"
date = "23.11.14"
score = 60
hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
strings:
$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
$s1 = "WinEggDrop.DLL" fullword ascii
$s2 = "nc.exe" fullword ascii
$s3 = "KeyLog.exe" fullword ascii
$s4 = "EditKeyLog.exe" fullword ascii
$s5 = "wineggdrop" fullword ascii
condition:
3 of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 6 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the rule “Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt”, including suggested filters and exclusions:
Scenario: Legacy Documentation Deployment via Scheduled Task
DeployDocs.ps1) that extracts a compressed archive containing the EditKeyLogReadMe.txt file into the shared network drive \\FileServer\LegacyDocs. This is a standard operational procedure for updating internal knowledge bases.DeployDocs.ps1) and the Destination Path containing \LegacyDocs\. Alternatively, exclude events where the file hash matches the known good hash of this specific readme file stored in the asset inventory.Scenario: Admin Manual Review during Onboarding
EditKeyLogReadMe.txt file located in C:\ProgramData\HRSystem\Config using Notepad++ to verify configuration settings for a new employee’s access profile. This is part of the standard onboarding checklist.IT-Admins or HR-Onboarding security groups and the Process Name is Notepad++.exe, Word.exe, or Outlook.exe.Scenario: Antivirus On-Demand Scan of Legacy Directories
EditKeyLogReadMe.txt file to check for embedded macros or script signatures.