Disclosed hacktool set - file GOGOGO.bat

Hunt Hypothesis

This detection identifies adversaries deploying custom batch scripts like GOGOGO.bat to establish persistence or execute initial reconnaissance tools within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because such generic filenames often mask malicious activity that could lead to lateral movement or data exfiltration if left undetected by standard signature-based rules.

YARA Rule

rule Hacktools_CN_GOGOGO_Bat {
	meta:
		description = "Disclosed hacktool set - file GOGOGO.bat"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
	strings:
		$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
		$s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
		$s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
		$s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
		$s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
		$s6 = "del /f tcpip.sys" fullword ascii
		$s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
		$s10 = "call scan.bat" fullword ascii
		$s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
		$s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
		$s18 = "sc config LmHosts start= auto" fullword ascii
		$s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
		$s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
	condition:
		3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 13 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set - file GOGOGO.bat”, including suggested filters and exclusions:

• Scenario: The IT Operations team utilizes a custom deployment batch script named GOGOGO.bat located in C:\Scripts\Deploy\ to automate the rollout of security patches via SCCM or Intune. This script is executed by the local SYSTEM account during nightly maintenance windows, triggering the rule due to the specific filename and extension often associated with hacktools.

  • Suggested Filter/Exclusion: Add a path-based exclusion for C:\Scripts\Deploy\GOGOGO.bat and filter alerts where the User Account is NT AUTHORITY\SYSTEM.

• Scenario: A third-party endpoint management tool (e.g., Ivanti or ManageEngine Desktop Central) generates a temporary batch file named GOGOGO.bat in the user’s %TEMP% directory to execute a specific “Go-Go” diagnostic routine for hardware inventory collection.

  • Suggested Filter/Exclusion: Exclude files located within paths containing \AppData\Local\Temp\ or \Program Files\ManageEngine\, and filter alerts where the Parent Process Name matches DesktopCentralAgent.exe.

• Scenario: The DevOps team runs a scheduled PowerShell job that invokes a legacy build script named GOGOGO.bat on the CI/CD server (e.g., Jenkins or Azure Dev Agents) to initialize the build environment before compiling code. This occurs frequently during business hours and is triggered by the service account svc-build-agent.

  • Suggested Filter/Exclusion: Create an exclusion for the specific host group “CI-CD Servers” and filter alerts where the User Account matches svc-build-agent or the hostname starts with Jenkins-.

• Scenario: The