This hunt hypothesis targets adversaries who have deployed legacy or previously disclosed hacking tools, specifically represented by the findoor.exe artifact, to establish a persistent foothold within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because outdated tooling often contains known vulnerabilities that attackers leverage to evade modern detection mechanisms and maintain long-term access.
rule sig_238_findoor {
meta:
description = "Disclosed hacktool set (old stuff) - file findoor.exe"
author = "Florian Roth"
date = "23.11.14"
score = 60
hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
strings:
$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
$s8 = "PASS [email protected]" fullword ascii
$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
$s10 = "MAIL FROM:[email protected]" fullword ascii
$s11 = "http://isno.yeah.net" fullword ascii
condition:
4 of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 5 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file findoor.exe detection rule, along with suggested filters and exclusions:
Legacy Printer Management Utility Execution
findoor.exe process is a known component of older HP Smart Printing Suite or legacy Xerox WorkCentre drivers. In an environment where IT administrators perform routine printer firmware updates or queue management via the GUI, this executable launches automatically in the background to scan for connected devices and driver inconsistencies.C:\Program Files\HP\Smart Printing Suite\findoor.exe (or equivalent vendor paths). Additionally, filter alerts where the parent process is spoolsv.exe or explorer.exe.Scheduled Office 365 ProPlus Health Check
findoor.exe) bundled within the older Office deployment package to identify missing components or corrupted files before the daily user login wave.TaskScheduler (specifically svchost.exe -k netsvcs) and the execution time falls strictly between 02:00 AM and 04:00 AM local time. Verify the file hash matches the known good signature for the Office deployment package.Endpoint DLP Agent Background Scanning
findoor.exe