← Back to SOC feed Coverage →

Disclosed hacktool set (old stuff) - file findoor.exe

yara HIGH Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-30T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis targets adversaries who have deployed legacy or previously disclosed hacking tools, specifically represented by the findoor.exe artifact, to establish a persistent foothold within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because outdated tooling often contains known vulnerabilities that attackers leverage to evade modern detection mechanisms and maintain long-term access.

YARA Rule

rule sig_238_findoor {
	meta:
		description = "Disclosed hacktool set (old stuff) - file findoor.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
	strings:
		$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
		$s8 = "PASS [email protected]" fullword ascii
		$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
		$s10 = "MAIL FROM:[email protected]" fullword ascii
		$s11 = "http://isno.yeah.net" fullword ascii
	condition:
		4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file findoor.exe detection rule, along with suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar