Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe

Hunt Hypothesis

This detection identifies adversaries deploying legacy reconnaissance and data exfiltration tools—specifically FsHttp.exe, FsPop.exe, and FsSniffer.exe—to map network traffic and capture sensitive information within the environment. A proactive hunt is essential in Azure Sentinel to uncover these often-overlooked artifacts that may indicate early-stage post-compromise activity or persistent lateral movement by threat actors utilizing established toolsets.

YARA Rule

rule _FsHttp_FsPop_FsSniffer {
	meta:
		description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		super_rule = 1
		hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
		hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
		hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
	strings:
		$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
		$s1 = "-ERR Get SMS Users ID Failed" fullword
		$s2 = "Control Time Out 90 Secs, Connection Closed" fullword
		$s3 = "-ERR Post SMS Failed" fullword
		$s4 = "Current.hlt" fullword
		$s6 = "Histroy.hlt" fullword
		$s7 = "-ERR Send SMS Failed" fullword
		$s12 = "-ERR Change Password <New Password>" fullword
		$s17 = "+OK Send SMS Succussifully" fullword
		$s18 = "+OK Set New Password: [%s]" fullword
		$s19 = "CHANGE PASSWORD" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set rule involving FsHttp.exe, FsPop.exe, and FsSniffer.exe, along with suggested filters:

• Scenario: Legacy File System Monitoring Suite Deployment on Endpoint Management Servers

  • Context: The enterprise utilizes a legacy “File System Monitor” suite (often found in older versions of CA ARCserve or similar backup/monitoring agents) where these executables run as background services to log I/O patterns and network traffic for audit compliance. They are often triggered by scheduled nightly jobs that scan the file system state.
  • Suggested Filter: Exclude processes FsHttp.exe, FsPop.exe, and FsSniffer.exe if they reside in a specific application directory (e.g., C:\Program Files\LegacyMonitorSuite\Bin\) and are launched by the parent process svchost.exe or the service controller services.exe.

• Scenario: Scheduled Network Traffic Analysis Job for Compliance Auditing

  • Context: A scheduled task configured to run every Monday at 02:00 AM executes a network traffic analysis script. This job invokes FsSniffer.exe to capture HTTP and POP3 headers from the internal mail gateway logs, which are stored locally before being archived. The rule triggers because these tools mimic known “hacktool” behavior by opening multiple sockets and reading configuration files.
  • Suggested Filter: Create an exclusion for events where the parent process is TaskScheduler.exe (or schtasks.exe) and the command line arguments contain specific keywords like /audit, /compliance, or reference to a known internal job ID (e.g., JobID: NET-ANALYSIS-WKLY).

• Scenario: Internal Developer Workstations Running Custom Debugging Tools

  • Context: Software engineering teams use a custom