Disclosed hacktool set - file nc.exe

Hunt Hypothesis

This detection identifies adversaries deploying the Netcat utility (nc.exe) as a disclosed hacktool to establish reverse shells or exfiltrate data through network connections. Proactively hunting for this behavior in Azure Sentinel is critical because nc.exe is frequently abused by threat actors to maintain persistence and command-and-control channels, often evading standard antivirus signatures due to its legitimate status.

YARA Rule

rule Ncat_Hacktools_CN {
	meta:
		description = "Disclosed hacktool set - file nc.exe"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "001c0c01c96fa56216159f83f6f298755366e528"
	strings:
		$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
		$s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
		$s3 = "gethostpoop fuxored" fullword ascii
		$s6 = "VERNOTSUPPORTED" fullword ascii
		$s7 = "%s [%s] %d (%s)" fullword ascii
		$s12 = " `--%s' doesn't allow an argument" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Disclosed hacktool set - file nc.exe” detection rule, along with suggested filters and exclusions:

• Scenario: Automated Network Diagnostics via Scheduled Task

  • Context: The enterprise IT Operations team runs a nightly scheduled task (e.g., Task Scheduler job named “NetCheck_Daily”) that executes nc.exe to verify connectivity between branch offices and the data center. This often triggers alerts when the process is spawned by System or NetworkService.
  • Suggested Filter: Exclude alerts where the parent process is svchost.exe (specifically the Schedule service) and the command line arguments contain specific diagnostic flags like -z, -v, or target internal IP ranges (e.g., 10.x.x.x).

• Scenario: Deployment of Configuration Management Tools

  • Context: During software deployment cycles, tools like Ansible, Chef, or SCCM (System Center Configuration Manager) utilize nc.exe as a lightweight transport mechanism to push configuration scripts or verify agent reachability on endpoints. These runs are often initiated by the Local System account.
  • Suggested Filter: Create an exclusion for processes spawned by known deployment binaries such as ccmexec.exe, chef-client.exe, or ansible-runner.exe. Additionally, filter out events where the user context is NT AUTHORITY\SYSTEM and the file path matches the standard installation directory of these tools.

• Scenario: Third-Party Monitoring Agent Connectivity Checks

  • Context: Endpoint monitoring solutions like Datadog, New Relic, or SolarWinds APM frequently invoke nc.exe to perform health checks against their collectors or to establish persistent connections for log shipping. These agents often run as background services under dedicated service accounts (