Disclosed hacktool set - file Http.exe

Hunt Hypothesis

This rule detects adversaries deploying a disclosed HTTP-based hacking tool named “Http.exe” to establish persistence or conduct reconnaissance within the environment. A proactive hunt is essential in Azure Sentinel because this specific tool signature indicates an active threat actor leveraging known utility files that may evade standard static analysis, requiring immediate investigation of associated network connections and process behaviors.

YARA Rule

rule Hacktools_CN_Http {
	meta:
		description = "Disclosed hacktool set - file Http.exe"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
	strings:
		$s0 = "RPCRT4.DLL" fullword ascii
		$s1 = "WNetAddConnection2A" fullword ascii
		$s2 = "NdrPointerBufferSize" fullword ascii
		$s3 = "_controlfp" fullword ascii
	condition:
		all of them and filesize < 10KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set - file Http.exe detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Edge “In-Private” or Kiosk Mode Launch

  • Context: When users launch Microsoft Edge in In-Private mode or a specific kiosk configuration, the browser often spawns a helper process named Http.exe (or similar variants depending on the build) to handle network requests and session isolation. This is common in shared workstations where multiple users log in sequentially.
  • Filter/Exclusion: Exclude processes where the parent executable (ParentImage) is msedge.exe AND the file path contains \Microsoft\Edge\Application\. Additionally, filter based on the specific SHA256 hash of the legitimate Microsoft-signed binary to distinguish it from a generic Http.exe in a random temp folder.

• Scenario: Scheduled Backup or Reporting Job via PowerShell

  • Context: Enterprise IT teams often deploy scheduled tasks (via Task Scheduler) that run nightly reports or backup scripts using PowerShell (powershell.exe) or Python wrappers. These scripts frequently invoke a lightweight HTTP client utility named Http.exe to push logs to internal SIEMs, ticketing systems (like ServiceNow), or cloud storage APIs.
  • Filter/Exclusion: Create an exclusion for events where the process name is Http.exe, the parent process is powershell.exe or python.exe, and the command line arguments contain specific keywords like --report, --push, or internal domain URLs (e.g., *.corp.local).

• Scenario: Endpoint Detection and Response (EDR) Telemetry Agent

  • Context: Many EDR solutions (such as CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint) utilize a background component named Http.exe to manage