Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the iKAT post-exploitation toolkit by detecting the execution of its core components—gpdisable.exe, kitrap0d.exe, and uacpoc.exe—which are frequently used to disable Group Policy, monitor network traffic, and bypass User Account Control. Proactively hunting for these specific artifacts in Azure Sentinel is critical because their presence often signals an attacker establishing persistence and evading security controls immediately after initial compromise.

YARA Rule

rule iKAT_Tool_Generic {
	meta:
		description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
		author = "Florian Roth"
		date = "05.11.14"
		score = 55
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		super_rule = 1
		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
		hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
		hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
	strings:
		$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
		$s1 = "Failed to read the entire file" fullword
		$s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
		$s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
		$s9 = "Running Zip pipeline..." fullword
		$s10 = "<FinTitle />" fullword
		$s12 = "<AutoTemp>0</AutoTemp>" fullword
		$s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
		$s15 = "AES Encrypting..." fullword
		$s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

References

• http://ikat.ha.cked.net/Windows/functions/ikatfiles.html
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the iKAT hack tool detection rule, including legitimate triggers and suggested filters/exclusions:

• Scenario: Endpoint Protection Agent Deployment

  • Context: The enterprise deploys a new version of an endpoint security agent (e.g., CrowdStrike Falcon or Microsoft Defender) which includes gpdisable.exe as part of its Group Policy enforcement module to temporarily disable legacy antivirus during updates.
  • Filter/Exclusion: Create an exclusion based on the Parent Process being the specific deployment engine (e.g., msiexec.exe, ccmsetup.exe, or falcon-sensor.exe) and restrict the rule to trigger only when these files run outside of standard business hours (09:00–17:00) unless initiated by a known Admin user.

• Scenario: Scheduled Group Policy Refresh Job

  • Context: A nightly scheduled task (gpupdate /force) executes on domain controllers and critical servers to refresh security policies, triggering kitrap0d.exe (iKAT’s policy trap daemon) to validate the new configuration against compliance baselines.
  • Filter/Exclusion: Exclude alerts where the Process Command Line contains specific flags indicating a scheduled run (e.g., /scheduled, /taskid:12345) and limit the scope to hosts belonging to the “Domain Controllers” or “Critical Infrastructure” Active Directory Organizational Unit (OU).

• Scenario: UAC Prompt Customization Tool Execution

  • Context: The IT Security team utilizes uacpoc.exe as part of a custom PowerShell script to audit User Account Control (UAC) settings across the fleet during quarterly compliance audits, often running via a centralized management console.
  • Filter/Exclusion: Implement an exclusion for processes launched by known administrative