Disclosed hacktool set - file pass.txt

Hunt Hypothesis

This detection identifies adversaries deploying a password harvesting tool that creates or modifies a pass.txt file to capture credentials and sensitive data within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because the presence of such a file often indicates an early-stage compromise where attackers are establishing persistence and exfiltrating authentication details before broader detection occurs.

YARA Rule

rule Hacktools_CN_Burst_pass {
	meta:
		description = "Disclosed hacktool set - file pass.txt"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "55a05cf93dbd274355d798534be471dff26803f9"
	strings:
		$s0 = "123456.com" fullword ascii
		$s1 = "123123.com" fullword ascii
		$s2 = "360.com" fullword ascii
		$s3 = "123.com" fullword ascii
		$s4 = "juso.com" fullword ascii
		$s5 = "sina.com" fullword ascii
		$s7 = "changeme" fullword ascii
		$s8 = "master" fullword ascii
		$s9 = "google.com" fullword ascii
		$s10 = "chinanet" fullword ascii
		$s12 = "lionking" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set - file pass.txt”, along with suggested filters or exclusions:

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: Automated build agents (e.g., Jenkins, GitHub Actions, Azure DevOps) often create temporary configuration files named pass.txt during the compilation of legacy applications or as part of a password rotation script within the build directory.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., Jenkins, GITHUB_ACTIONS) and restrict the scope to known CI/CD directories (e.g., C:\Builds\* or /var/lib/jenkins/workspace/*).

• Scenario: Scheduled Password Reset Utility

  • Context: A nightly scheduled task runs a custom PowerShell script (Reset-UserPasswords.ps1) that exports new temporary passwords for onboarding employees into a file named pass.txt located in the HR department’s shared drive before archiving them.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., powershell.exe or cscript.exe) and the specific file path pattern (\\HR-Share\Onboarding\pass.txt).

• Scenario: Legacy Terminal Emulator Configuration

  • Context: Administrative staff using legacy terminal tools like PuTTY or SecureCRT often save session credentials or command logs to a local pass.txt file within their user profile directory when configuring SSH connections for server maintenance.
  • Filter/Exclusion: Filter out events where the process name is PuTTY.exe, SecureCRT.exe, or mstsc.exe and the file path resides within standard user profiles (C:\Users\*\AppData\Local\*).

• **Scenario: Automated Backup Verification