← Back to SOC feed Coverage →

Disclosed hacktool set (old stuff) - file concon.com

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-30T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies legacy or potentially compromised hacking tools associated with the “concon.com” file signature that may indicate an adversary establishing a foothold through outdated software components. Proactively hunting for this behavior in Azure Sentinel is critical to uncover dormant threats that traditional rules might miss, ensuring early identification of reconnaissance activities before they escalate into active breaches.

YARA Rule

rule sig_238_concon {
	meta:
		description = "Disclosed hacktool set (old stuff) - file concon.com"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
	strings:
		$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file concon.com detection rule, along with targeted filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar