Disclosed hacktool set (old stuff) - file filespy.exe

Hunt Hypothesis

This rule detects adversaries deploying legacy or known malicious tools like filespy.exe to establish a foothold and conduct reconnaissance within the environment. A proactive hunt is essential in Azure Sentinel to identify these potentially overlooked artifacts that may indicate early-stage intrusion attempts or the reuse of old attack vectors by threat actors.

YARA Rule

rule sig_238_filespy {
	meta:
		description = "Disclosed hacktool set (old stuff) - file filespy.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 50
		hash = "89d8490039778f8c5f07aa7fd476170293d24d26"
	strings:
		$s0 = "Hit [Enter] to begin command mode..." fullword ascii
		$s1 = "If you are in command mode," fullword ascii
		$s2 = "[/l] lists all the drives the monitor is currently attached to" fullword ascii
		$s9 = "FileSpy.exe" fullword wide
		$s12 = "ERROR starting FileSpy..." fullword ascii
		$s16 = "exe\\filespy.dbg" fullword ascii
		$s17 = "[/d <drive>] detaches monitor from <drive>" fullword ascii
		$s19 = "Should be logging to screen..." fullword ascii
		$s20 = "Filmon:  Unknown log record type" fullword ascii
	condition:
		7 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file filespy.exe detection rule, including suggested filters and exclusions:

• Scenario: Legacy Asset Management Scans

  • Context: The enterprise utilizes a legacy version of SolarWinds Service Desk or ManageEngine Desktop Central. These tools often deploy an agent named filespy.exe to perform periodic hardware inventory scans, network discovery, and license compliance checks. Because this is a scheduled background task running under the SYSTEM account, it mimics the behavior of a known hacktool.
  • Suggested Filter/Exclusion: Exclude processes where the parent process is svchost.exe (specifically the “Local System” service) or wuauserv.exe, and the file path resides within C:\Program Files\SolarWinds\ or C:\ManageEngine\DesktopCentral\Agent\.

• Scenario: Scheduled Endpoint Security Health Checks

  • Context: The organization runs a nightly maintenance job using Trend Micro Apex One (or similar legacy endpoint protection suites). During the “Health Check” phase, the agent launches filespy.exe to audit local registry keys and verify the integrity of security policies. This executable is often located in a subdirectory dedicated to utilities rather than the main installation folder.
  • Suggested Filter/Exclusion: Create an exclusion for files with the hash SHA256: [Insert Known Hash] or filter by file path containing \Trend Micro\ApexOne\Components\filespy.exe. Additionally, exclude events occurring during the defined maintenance window (e.g., 02:00–04:00 daily).

• Scenario: Third-Party Remote Monitoring Tools

  • Context: The Help Desk team utilizes TeamViewer or