← Back to SOC feed Coverage →

This signature detects the Fierce2 domain scanner

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-27T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies active reconnaissance efforts by the Fierce2 domain scanner, signaling an adversary’s initial phase of mapping network boundaries and identifying live hosts within the Azure Sentinel environment. Proactive hunting for this signature is critical to uncover early-stage threat intelligence gathering that often precedes more aggressive exploitation attempts, allowing the SOC team to prioritize defensive measures before attackers establish a foothold.

YARA Rule

rule Fierce2
{
	meta:
		author = "Florian Roth"
		description = "This signature detects the Fierce2 domain scanner"
		date = "07/2014"
		score = 60
	strings:
		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the Fierce2 Domain Scanner detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar