Disclosed hacktool set - file Burst.rar

Hunt Hypothesis

This rule detects adversaries deploying compressed archive files like “Burst.rar” to conceal and deliver malicious hacking tools that may evade initial signature-based scanning. Proactive hunting for this behavior in Azure Sentinel is critical because attackers frequently use such archives to stage post-exploitation tools, allowing them to establish a foothold before executing their primary payload.

YARA Rule

rule Hacktools_CN_Panda_Burst {
	meta:
		description = "Disclosed hacktool set - file Burst.rar"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
	strings:
		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Disclosed hacktool set - file Burst.rar” detection rule, including targeted filters and exclusions:

• Scenario: Automated Patch Deployment via RAR Archives

  • Context: The IT Operations team utilizes a scheduled task to distribute patch bundles (e.g., Windows Updates or third-party software) compressed in .rar format. These archives are extracted by the deployment engine (such as Microsoft Endpoint Configuration Manager (MECM) or PDQ Deploy) on endpoint machines, triggering the rule when the extraction process creates temporary files named Burst.rar.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under the context of known deployment agents.
    • Filter: Exclude alerts where the parent process is ccmexec.exe (MECM) or pdqagent.exe and the file path resides within a dedicated patch distribution folder (e.g., C:\ProgramData\PatchBurst\).

• Scenario: Software Asset Management Inventory Scans

  • Context: Enterprise asset management tools like ServiceNow Discovery, Lansweeper, or Flexera One periodically scan endpoints to inventory installed software. These agents often bundle discovery scripts and configuration files into a compressed archive named Burst.rar during the scanning window, which is then unpacked by the agent service.
  • Suggested Filter/Exclusion: Exclude alerts based on specific service accounts or process names associated with asset management tools.
    • Filter: Suppress detections where the user context is a dedicated service account (e.g., svc-discovery or svc-inventory) and the file path matches the agent’s working directory pattern (e.g., C:\Program Files\Lansweeper\Agent\Temp\Burst.rar).

• **Scenario: Scheduled Backup of Configuration Snap