iKAT hack tool set generic rule - from files gpdisable.exe, customcmd.exe, kitrap0d.exe, uacpoc.exe

Hunt Hypothesis

This detection identifies the execution of known iKAT hacking tools (gpdisable.exe, customcmd.exe, kitrap0d.exe, and uacpoc.exe) that adversaries frequently deploy to disable security controls or establish persistence on compromised endpoints. Proactive hunting for these specific binaries in Azure Sentinel is essential because their presence often signals early-stage reconnaissance or post-exploitation activities that may be missed by standard alerting due to the rule’s low severity classification.

YARA Rule

rule iKAT_gpdisable_customcmd_kitrap0d_uacpoc {
	meta:
		description = "iKAT hack tool set generic rule - from files gpdisable.exe, customcmd.exe, kitrap0d.exe, uacpoc.exe"
		author = "Florian Roth"
		date = "05.11.14"
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		super_rule = 1
		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
		hash1 = "2725690954c2ad61f5443eb9eec5bd16ab320014"
		hash2 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
		hash3 = "b65a460d015fd94830d55e8eeaf6222321e12349"
		score = 20
	strings:
		$s0 = "Failed to get temp file for source AES decryption" fullword
		$s5 = "Failed to get encryption header for pwd-protect" fullword
		$s17 = "Failed to get filetime" fullword
		$s20 = "Failed to delete temp file for password decoding (3)" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://ikat.ha.cked.net/Windows/functions/ikatfiles.html
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the iKAT hack tool set generic rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Group Policy Maintenance

  • Context: The file gpdisable.exe is frequently executed by the built-in Windows Task Scheduler during off-hours to temporarily disable specific Group Policies before a major update or patch deployment. This often triggers on domain-joined workstations when an admin runs a maintenance script.
  • Suggested Filter/Exclusion: Create an exclusion rule that suppresses alerts for gpdisable.exe if the parent process is TaskSchedulerService.exe (or svchost.exe) and the execution occurs between 02:00 and 05:00 local time. Additionally, filter by User Account to only allow executions initiated by the DOMAIN\Admins group or a specific service account like svc-gp-maint.

• Scenario: Endpoint Security Policy Enforcement

  • Context: The file customcmd.exe is utilized by enterprise endpoint protection suites (e.g., CrowdStrike, Microsoft Defender for Endpoint) to run custom remediation scripts. These scripts often launch customcmd.exe to apply security configurations or whitelist specific applications automatically upon user login.
  • Suggested Filter/Exclusion: Exclude alerts where the command line arguments contain keywords like “policy,” “whitelist,” or “remediate.” Furthermore, add a hash-based exclusion for the known good SHA-256 hash of customcmd.exe deployed by your specific EDR vendor to ensure only authorized versions trigger this rule.

• Scenario: UAC Bypass Testing and Deployment

  • Context: The file uacpoc.exe is commonly used during the rollout phase of new software or when IT staff perform User Account Control (UAC) bypass testing