This detection identifies legacy or potentially compromised hacking tools associated with the “concon.com” file signature that may indicate an adversary establishing a foothold through outdated software components. Proactively hunting for this behavior in Azure Sentinel is critical to uncover dormant threats that traditional rules might miss, ensuring early identification of reconnaissance activities before they escalate into active breaches.
rule sig_238_concon {
meta:
description = "Disclosed hacktool set (old stuff) - file concon.com"
author = "Florian Roth"
date = "23.11.14"
score = 60
hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
strings:
$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file concon.com detection rule, along with targeted filters and exclusions:
Scenario: Legacy Network Monitoring Utility Execution
ConCom for bandwidth analysis. This legacy application periodically spawns the executable concon.com (or a similarly named binary) to scan network interfaces and log traffic patterns, which mimics the behavior of a disclosed hacktool.concon.com) combined with a specific Parent Process (e.g., SolarWinds.Agent.exe or TaskScheduler.exe). Additionally, restrict this to a known File Path such as C:\Program Files\SolarWinds\Tools\concon.com.Scenario: Scheduled Automated Compliance Audit Job
concon.com which aggregates logs from various departments. Because this tool is “old stuff,” it may not have modern signing certificates, triggering the rule as a potential hacktool deployment.ComplianceAudit or NightlyScan. Alternatively, filter by User Context, excluding runs performed under the dedicated service account svc-compliance-audit.Scenario: Legacy Hardware Management Agent Deployment