Disclosed hacktool set (old stuff) - file FPipe.exe

Hunt Hypothesis

This rule detects adversaries utilizing legacy hacking tools like FPipe.exe to establish persistence or execute malicious payloads within the environment. Proactive hunting for this behavior in Azure Sentinel is critical because outdated tooling often lacks modern security controls, making it a high-value target for exploitation and lateral movement attacks.

YARA Rule

rule sig_238_FPipe {
	meta:
		description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
	strings:
		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
		$s2 = "source port for that outbound connection being set to 53 also." fullword ascii
		$s3 = " -s    - outbound source port number" fullword ascii
		$s5 = "http://www.foundstone.com" fullword ascii
		$s20 = "Attempting to connect to %s port %d" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file FPipe.exe detection rule, along with recommended filters or exclusions:

• Scenario: Legacy Terminal Server Session Broker Execution

  • Context: In environments running older versions of Microsoft Remote Desktop Services (RDS), FPipe.exe is often executed as part of the session broker process to manage file redirection and pipe communication between client and server. This is a standard administrative task rather than an anomaly.
  • Filter/Exclusion: Exclude processes where the parent executable is rdclip.exe or wsmprovhost.exe running under the SYSTEM or NETWORK SERVICE account, specifically within the path C:\Windows\System32\.

• Scenario: Citrix Workspace App File Redirection

  • Context: Organizations utilizing Citrix Virtual Apps and Desktops often rely on a component named FPipe.exe (File Pipe) to handle file transfer and clipboard redirection between the virtual desktop and the local user session. This triggers frequently during routine user logins or file uploads.
  • Filter/Exclusion: Create an exclusion for any process instance where the command line contains arguments related to “Citrix” or “ICA”, and the binary path resides within C:\Program Files\Citrix\ or C:\ProgramData\Citrix\.

• Scenario: Scheduled Backup Job via Robocopy Wrapper

  • Context: Many enterprise backup solutions (such as Veeam or custom PowerShell scripts) utilize a wrapper script that invokes FPipe.exe to facilitate high-speed data piping during nightly scheduled maintenance windows. This often occurs between 02:00 and 04:00 on weekdays.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts for this rule