Disclosed hacktool set - file scan.bat

Hunt Hypothesis

This hypothesis detects adversaries deploying a batch script named “scan.bat” as part of their initial tooling phase to establish persistence or execute reconnaissance commands on compromised hosts. A proactive hunt is essential in Azure Sentinel because such generic filenames often mask malicious activity that evades standard signature-based detections, allowing attackers to operate undetected during the early stages of an intrusion.

YARA Rule

rule Hacktools_CN_Scan_BAT {
	meta:
		description = "Disclosed hacktool set - file scan.bat"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
	strings:
		$s0 = "for /f %%a in (host.txt) do (" fullword ascii
		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
		$s2 = "del host.txt /q" fullword ascii
		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
		$s4 = "start Http.exe %%a %http%" fullword ascii
		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set - file scan.bat detection rule, including tailored filters and exclusions:

• Scenario: Scheduled Backup Verification Job

  • Context: The enterprise backup solution (e.g., Veeam or Commvault) utilizes a nightly scheduled task that executes scan.bat to verify the integrity of critical database backups before archiving. This script is located in the backup agent’s installation directory and runs under a dedicated service account.
  • Filter/Exclusion: Create an exclusion rule based on the file path (e.g., C:\Program Files\Veeam\Backup\Jobs\scan.bat) AND the user context (DOMAIN\BackupServiceAccount). Additionally, exclude this specific hash if it remains static over a 30-day period.

• Scenario: Endpoint Security Agent Self-Check

  • Context: The deployed EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) runs a periodic self-diagnostic routine using a local batch script named scan.bat to check for agent health and configuration drift. This occurs during off-hours maintenance windows.
  • Filter/Exclusion: Filter out events where the parent process is the EDR service executable (e.g., falcon.sys, MsMpEng.exe) AND the file path resides within the vendor’s protected system directory (e.g., C:\ProgramData\CrowdStrike\).

• Scenario: IT Admin Manual Patch Deployment

  • Context: During a planned maintenance window, an System Administrator manually executes scan.bat from a shared network drive (\\FileServer\Patches) to validate the contents of a new software patch package before pushing it to the fleet. The script is run via PowerShell or CMD with elevated privileges.
  • Filter/Exclusion: Exclude events where the