Disclosed hacktool set (old stuff) - file FPipe2.0.exe

Hunt Hypothesis

This detection identifies the execution of legacy hacking tools like FPipe2.0.exe, which adversaries often deploy to establish persistence or conduct reconnaissance on compromised endpoints. Proactively hunting for these artifacts in Azure Sentinel is critical because outdated hacktool executables frequently evade standard signature-based defenses and may indicate a stealthy initial access phase that requires immediate investigation before lateral movement occurs.

YARA Rule

rule FPipe2_0 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "891609db7a6787575641154e7aab7757e74d837b"
	strings:
		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
		$s2 = " -s    - outbound connection source port number" fullword ascii
		$s3 = "source port for that outbound connection being set to 53 also." fullword ascii
		$s4 = "http://www.foundstone.com" fullword ascii
		$s19 = "FPipe" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file FPipe2.0.exe”, along with suggested filters and exclusions:

• Scenario: Legacy Terminal Services Licensing Service

  • Context: In environments utilizing older versions of Windows Server (e.g., 2012 R2 or 2016), the FPipe2.0.exe process is often a component of the legacy Terminal Services licensing infrastructure or specific third-party remote desktop gateways that have not yet been migrated to newer stacks.
  • Suggested Filter/Exclusion: Create an exclusion based on the file path and parent process. Exclude any instance where FPipe2.0.exe resides in C:\Program Files\Microsoft Terminal Services\ or is spawned by lsass.exe (Local Security Authority Subsystem Service).
  • Filter Logic: Path contains "Terminal Services" AND ParentProcessName == "lsass.exe"

• Scenario: Scheduled Maintenance for Third-Party Backup Agents

  • Context: Enterprise backup solutions like Veeam or Commvault often utilize a helper utility named FPipe2.0.exe during nightly scheduled jobs to manage data pipes between the agent and the repository server. This triggers the rule when the job runs outside of business hours.
  • Suggested Filter/Exclusion: Implement a time-based exclusion window combined with a specific service name check. Exclude alerts generated between 01:00 and 05:00 local time where the process is associated with the “Veeam Backup Service” or similar backup daemon.
  • Filter Logic: (Time BETWEEN '01:00' AND '05:00') AND (ServiceName contains "Backup")

• **Scenario: Deployment of Legacy