Disclosed hacktool set (old stuff) - file readme.txt

Hunt Hypothesis

This detection identifies adversaries deploying legacy hacking toolkits that utilize a readme.txt file to disclose their presence or deliver initial payloads within the Azure environment. Proactive hunting for this specific artifact is critical because such files often serve as indicators of compromise from dormant threats or reconnaissance activities that may have bypassed standard automated alerts due to their age and common naming convention.

YARA Rule

rule PassSniffer_zip_Folder_readme {
	meta:
		description = "Disclosed hacktool set (old stuff) - file readme.txt"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
	strings:
		$s0 = "PassSniffer.exe" fullword ascii
		$s1 = "POP3/FTP Sniffer" fullword ascii
		$s2 = "Password Sniffer V1.0" fullword ascii
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file readme.txt”, including suggested filters and exclusions:

• Legacy Documentation Deployment by IT Operations

  • Scenario: The IT Operations team deploys a standardized “Welcome Kit” to new employee workstations using SCCM or Intune. This kit includes a legacy readme.txt file containing onboarding instructions, which is created in the user’s root directory (C:\Users\Public\Documents) during the provisioning phase.
  • Filter/Exclusion: Exclude files named readme.txt located specifically within the path C:\Users\Public\Documents\OnboardingKit\*. Additionally, filter out events where the process name is ccmsetup.exe (SCCM) or Microsoft.IntuneManagementExtension.exe.

• Scheduled Backup Verification Job

  • Scenario: A nightly maintenance script executed by a backup administrator creates a temporary readme.txt in the root of the backup volume (D:\Backup\Logs) to document the current backup cycle status and version. This file is generated by a custom PowerShell script running under the SYSTEM account every night at 02:00 AM.
  • Filter/Exclusion: Create an exclusion for events where the source path matches D:\Backup\Logs\* AND the process name is powershell.exe. Further refine by excluding events occurring between 01:30 and 03:00 daily.

• Third-Party Antivirus Signature Update

  • Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or SentinelOne) performs a signature update package installation. As part of the post-installation verification, the agent creates a readme.txt in its local data directory (`C:\ProgramData\Crow