This detection identifies adversaries leveraging the iKAT hack tool (revelations.exe) to extract sensitive credentials from memory by revealing hidden password field contents. SOC teams should proactively hunt for this activity in Azure Sentinel because it indicates a high-severity post-exploitation phase where attackers are actively harvesting authentication data to facilitate lateral movement or privilege escalation.
rule iKAT_revelations {
meta:
description = "iKAT hack tool showing the content of password fields - file revelations.exe"
author = "Florian Roth"
date = "05.11.14"
score = 75
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
strings:
$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
$s8 = "[email protected]" fullword wide
$s9 = "[email protected]" fullword wide
$s14 = "RevelationHelper.dll" fullword ascii
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 4 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the iKAT hack tool showing the content of password fields detection rule (revelations.exe), along with suggested filters or exclusions:
Scenario: Scheduled Password Audit by Security Team
revelations.exe via a scheduled PowerShell task to scan the C:\Dev\SourceControl directory for exposed credentials.DOMAIN\SecurityAuditBot) and the Parent Process (powershell.exe). Additionally, restrict the detection scope to exclude file paths matching C:\Dev\SourceControl\*.Scenario: Post-Migration Data Validation by DevOps Engineers
revelations.exe on the build server (BUILD-SRV-01) to validate that password fields in configuration files (.xml, .json) were correctly populated during the transfer.BUILD-SRV-01, MIGRATION-WIN-04). Alternatively, add a filter where the Command Line Arguments contain keywords like --validate or --migration-check.Scenario: Compliance Reporting Tool Integration
revelations.exe as a subprocess to extract and redact sensitive password data from the central repository before