iKAT hack tools set agent - file ikat.exe

Hunt Hypothesis

This detection rule identifies the execution of ikat.exe, a known component of the iKAT hacking toolkit often utilized by adversaries for reconnaissance and lateral movement within compromised networks. Proactively hunting for this file in Azure Sentinel is critical to uncover early-stage intrusions where threat actors deploy specialized tooling to establish persistence or gather intelligence before escalating their attack chain.

YARA Rule

rule iKAT_command_lines_agent {
	meta:
		description = "iKAT hack tools set agent - file ikat.exe"
		author = "Florian Roth"
		date = "05.11.14"
		score = 75
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
	strings:
		$s0 = "Extended Module: super mario brothers" fullword ascii
		$s1 = "Extended Module: " fullword ascii
		$s3 = "ofpurenostalgicfeeling" fullword ascii
		$s8 = "-supermariobrotheretic" fullword ascii
		$s9 = "!http://132.147.96.202:80" fullword ascii
		$s12 = "iKAT Exe Template" fullword ascii
		$s15 = "withadancyflavour.." fullword ascii
		$s16 = "FastTracker v2.00   " fullword ascii
	condition:
		4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• http://ikat.ha.cked.net/Windows/functions/ikatfiles.html
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the iKAT hack tools set agent - file ikat.exe detection rule, including suggested filters and exclusions:

• Scheduled Endpoint Security Scans

  • Scenario: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) runs a daily scheduled scan at 02:00 AM. During this process, the security agent spawns ikat.exe as part of its heuristic analysis module to verify file integrity on critical system directories.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., CrowdStrike.exe or MsMpEng.exe) and restrict the trigger to a specific time window (01:30–02:30 AM). Alternatively, whitelist the hash of the legitimate ikat.exe binary used by the security vendor.

• IT Admin Deployment via SCCM/Intune

  • Scenario: An IT administrator initiates a mass deployment of a new patch or configuration update using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment package includes the ikat.exe utility to validate network connectivity and agent status on 50+ workstations simultaneously, triggering the rule across multiple hosts.
  • Filter/Exclusion: Exclude events where the user context is a known service account (e.g., DOMAIN\SCCM-Deploy-Svc) or filter by the specific file path of the deployment package (e.g., C:\ProgramData\Microsoft\Intune Management Extension\).

• Third-Party Backup Solution Initialization

  • Scenario: The organization uses Veeam Backup & Replication. When a backup job initiates, the Veeam Agent for Windows launches ikat.exe to perform pre-backup health checks and inventory scanning of mounted volumes before data transfer begins.