Disclosed hacktool set - file JoHor_Posts_Killer.exe

Hunt Hypothesis

This detection identifies adversaries deploying the specific hacktool “JoHor_Posts_Killer.exe,” which is indicative of reconnaissance or post-exploitation activities aimed at disabling security controls or gathering system information. A SOC team should proactively hunt for this artifact in Azure Sentinel to validate its legitimacy and prevent potential lateral movement, as unauthorized execution of such tools often signals the early stages of a broader compromise within the environment.

YARA Rule

rule Hacktools_CN_JoHor_Posts_Killer {
	meta:
		description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
	strings:
		$s0 = "Multithreading Posts_Send Killer" fullword ascii
		$s3 = "GET [Access Point] HTTP/1.1" fullword ascii
		$s6 = "The program's need files was not exist!" fullword ascii
		$s7 = "JoHor_Posts_Killer" fullword wide
		$s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
		$s10 = "  ( /s ) :" fullword ascii
		$s11 = "forms.vbp" fullword ascii
		$s12 = "forms.vcp" fullword ascii
		$s13 = "Software\\FlySky\\E\\Install" fullword ascii
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule Disclosed hacktool set - file JoHor_Posts_Killer.exe, along with suggested filters or exclusions:

• Scenario: Scheduled Social Media Management

  • Context: The marketing team uses a third-party social media scheduler (e.g., Hootsuite, Buffer, or Sprout Social) that includes a local agent named JoHor_Posts_Killer.exe to manage post queues and clean up temporary cache files on the endpoint. This tool runs daily at 09:00 AM via Windows Task Scheduler under the “SYSTEM” account.
  • Suggested Filter: Create an exclusion rule that allows execution of C:\Program Files\JoHor\PostManager\JoHor_Posts_Killer.exe when run by the NT SERVICE\TaskScheduler or specific service accounts (e.g., svc-marketing).

• Scenario: IT Helpdesk Remote Session Cleanup

  • Context: During remote support sessions, the helpdesk team utilizes a custom utility suite to clear browser history and temporary post-data artifacts on user machines before closing the session. This tool is often launched manually by the “IT Admin” group or triggered via Group Policy startup scripts.
  • Suggested Filter: Exclude the file hash (SHA-256) of the known good version of JoHor_Posts_Killer.exe located in C:\ProgramData\HelpdeskTools\. Additionally, exclude execution paths where the parent process is a remote desktop service (rdclip.exe) or a Group Policy client (gpupdate.exe).

• Scenario: Legacy CRM Data Synchronization

  • Context: A legacy Customer Relationship Management (CRM) system relies on JoHor_Posts_Killer.exe as a background daemon to synchronize “Post” data entries between the local database and the cloud. This process