← Back to SOC feed Coverage →

iKAT hack tool showing the content of password fields - file revelations.exe

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-28T11:00:01Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversaries leveraging the iKAT hack tool (revelations.exe) to extract sensitive credentials from memory by revealing hidden password field contents. SOC teams should proactively hunt for this activity in Azure Sentinel because it indicates a high-severity post-exploitation phase where attackers are actively harvesting authentication data to facilitate lateral movement or privilege escalation.

YARA Rule

rule iKAT_revelations {
	meta:
		description = "iKAT hack tool showing the content of password fields - file revelations.exe"
		author = "Florian Roth"
		date = "05.11.14"
		score = 75
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
	strings:
		$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
		$s8 = "[email protected]" fullword wide
		$s9 = "[email protected]" fullword wide
		$s14 = "RevelationHelper.dll" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the iKAT hack tool showing the content of password fields detection rule (revelations.exe), along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar