Disclosed hacktool set - file tesksd.jpg

Hunt Hypothesis

This hunt hypothesis targets adversaries who establish persistence or execute malicious payloads by disguising a hacking tool as an image file named “tesksd.jpg” to evade initial scrutiny based on its benign extension. SOC teams should proactively investigate this anomaly in Azure Sentinel because the mismatch between the .jpg extension and the underlying hacktool functionality often indicates a sophisticated evasion tactic that could lead to undetected lateral movement or data exfiltration if not identified early.

YARA Rule

rule Hacktools_CN_Panda_tesksd {
	meta:
		description = "Disclosed hacktool set - file tesksd.jpg"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
	strings:
		$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
		$s1 = "ExeMiniDownload.exe" fullword wide
		$s16 = "POST %Hs" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the detection rule “Disclosed hacktool set - file tesksd.jpg”, including suggested filters and exclusions:

• Scenario: Scheduled Backup of Task Scheduler Logs

  • Context: The enterprise backup solution (e.g., Veeam or Commvault) runs a nightly job that archives system logs. As part of this process, the backup agent creates a temporary snapshot image named tesksd.jpg within the %SystemRoot%\System32\Tasks directory to verify log integrity before compression.
  • Filter/Exclusion: Add an exclusion for the specific file path where the backup agent operates (e.g., C:\Windows\System32\Tasks\BackupSnapshot\tesksd.jpg) and exclude processes running under the service account of the backup tool (e.g., Veeam.Backup.Service.exe or Commvault.AGENT).

• Scenario: Automated Compliance Reporting Tool

  • Context: A third-party compliance scanner (such as Qualys Cloud Agent or Tenable Nessus) generates a daily PDF report containing embedded charts. The tool uses an internal image generator that saves the chart visualization as tesksd.jpg in the temporary directory before embedding it into the final report document.
  • Filter/Exclusion: Create a filter to exclude file creation events where the parent process is the compliance agent (e.g., qualyspc.exe or tenable_agent.exe) and the destination folder matches the known report generation path (e.g., C:\ProgramData\Qualys\Reports\).

• Scenario: IT Admin Manual Documentation via PowerShell

  • Context: System administrators frequently run custom PowerShell scripts to document current task configurations. These scripts often utilize a helper function that renders a visual diagram of the task dependencies, saving it as `tesksd.jpg