Disclosed hacktool set (old stuff) - file PassSniffer.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying legacy password sniffing tools like PassSniffer.exe to capture credentials in transit or at rest within the environment. A proactive search is essential because these older utilities often lack modern security signatures and can be leveraged by attackers to silently exfiltrate sensitive authentication data before standard detection mechanisms trigger an alert.

YARA Rule

rule PassSniffer {
	meta:
		description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
	strings:
		$s2 = "Sniff" fullword ascii
		$s3 = "GetLas" fullword ascii
		$s4 = "VersionExA" fullword ascii
		$s10 = " Only RuntUZ" fullword ascii
		$s12 = "emcpysetprintf\\" fullword ascii
		$s13 = "WSFtartup" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PassSniffer.exe detection rule, including suggested filters and exclusions:

• Legacy Password Auditing Tool Deployment

  • Scenario: The enterprise utilizes a legacy third-party password auditing suite (e.g., BeyondTrust Password Manager or an older version of ManageEngine Desktop Central) that deploys PassSniffer.exe as a background service to capture and analyze credential usage patterns during user logon sessions. This file is often installed in the C:\Program Files\LegacyAuditTools\ directory and runs under the context of a dedicated service account (e.g., svc_audit).
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the process path matches C:\Program Files\LegacyAuditTools\PassSniffer.exe AND the user context is NT SERVICE\PasswordAuditSvc.

• Scheduled Credential Health Check Job

  • Scenario: A nightly scheduled task named “Q3_Credential_Health_Check” runs via Windows Task Scheduler to audit stored credentials in the vault. This job explicitly launches PassSniffer.exe located in a custom script directory (C:\Scripts\Security\Tools\) to sniff active sessions and generate compliance reports before archiving them.
  • Filter/Exclusion: Exclude alerts where the parent process is svchost.exe (specifically the Schedule service) AND the file path contains \Scripts\Security\Tools\PassSniffer.exe.

• Domain Admin Manual Investigation

  • Scenario: A Domain Administrator manually launches PassSniffer.exe from a jump host to troubleshoot intermittent authentication failures for a specific department. The tool is executed directly via command line or shortcut by an account with high privileges (e.g., DOMAIN\Admins\jdoe) rather than being triggered automatically by a service.