Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt

Hunt Hypothesis

This detection identifies adversaries leveraging legacy hacktools like Jc.WinEggDrop to establish a foothold or execute shell commands within the environment. Proactive hunting is essential in Azure Sentinel to uncover dormant threats that may have evaded initial automated defenses by utilizing older, less scrutinized tooling artifacts.

YARA Rule

rule Jc_WinEggDrop_Shell {
	meta:
		description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
	strings:
		$s0 = "Sniffer.dll" fullword ascii
		$s4 = ":Execute net.exe user Administrator pass" fullword ascii
		$s5 = "Fport.exe or mport.exe " fullword ascii
		$s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
		$s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
		$s15 = ": Del www.exe                   " fullword ascii
		$s20 = ":Dir *.exe                    " fullword ascii
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt detection rule, including suggested filters and exclusions:

• Legacy Asset Management Scans via SCCM/Intune

  • Scenario: The enterprise utilizes Microsoft Endpoint Configuration Manager (SCCM) or Intune to push legacy hardware inventory agents. These agents often deploy a shell script named Jc.WinEggDrop Shell.txt during nightly maintenance windows to enumerate old hardware drivers and registry keys, triggering the “old stuff” heuristic due to file age and naming convention.
  • Filter/Exclusion: Create an exclusion for files located in C:\Program Files\Microsoft Configuration Manager\AdminConsole\ or C:\Windows\CCM\Logs\. Additionally, filter out events where the process name is ccmsetup.exe or IntuneManagementExtension.exe and the file path contains “WinEggDrop”.

• Third-Party Antivirus Heuristic Updates

  • Scenario: A legacy endpoint protection suite (e.g., Symantec Endpoint Protection or older McAfee versions) performs a periodic heuristic update. The update package includes a diagnostic shell script named Jc.WinEggDrop Shell.txt to validate the integrity of the “old stuff” detection engine before applying new signatures, causing the rule to fire on every agent heartbeat.
  • Filter/Exclusion: Exclude file paths containing \Symantec\ or \McAfee\. Implement a filter that suppresses alerts if the parent process is symantec.exe, mfevcservice.exe, and the file modification time matches the scheduled update window (e.g., 02:00–04:00 local time).

• Scheduled PowerShell Maintenance Jobs

  • Scenario: IT Operations