Disclosed hacktool set (old stuff) - file Glass2k.exe

Hunt Hypothesis

This detection identifies the presence of the obsolete Glass2k.exe hacktool, signaling potential adversary activity involving legacy or repurposed reconnaissance tools that may indicate early-stage intrusion efforts. Proactive hunting for this artifact is critical in Azure Sentinel to uncover hidden threats leveraging outdated software, which often escape standard signature-based defenses and could serve as a foothold for lateral movement or data exfiltration.

YARA Rule

rule sig_238_Glass2k {
	meta:
		description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
	strings:
		$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
		$s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
		$s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
		$s4 = "Glass2k.exe" fullword wide
		$s7 = "NeoLite Executable File Compressor" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the sig_238_Glass2k detection rule, along with targeted filtering strategies:

• Legacy Inventory Management Scans

  • Scenario: The IT Asset Management team runs a nightly scheduled job using SolarWinds Service Desk or Lansweeper, which deploys the Glass2k.exe utility to legacy Windows 7/Server 2012 R2 endpoints to gather hardware sensor data and BIOS information.
  • Filter/Exclusion: Exclude files located in the specific inventory agent directory: C:\Program Files\SolarWinds\InventoryAgent\Tools\Glass2k.exe (or equivalent path for Lansweeper), and restrict the rule trigger to only fire on non-standard user directories (e.g., exclude Program Files).

• Third-Party Endpoint Protection Scans

  • Scenario: An older version of Trend Micro Apex One or Symantec Endpoint Protection utilizes Glass2k.exe as a background diagnostic component during its “Deep Scan” mode, specifically when analyzing the system registry and driver integrity on workstations older than 3 years.
  • Filter/Exclusion: Create an exclusion based on the parent process name; if Glass2k.exe is spawned by tmengine.exe, Symantec Antivirus Console.exe, or Trend Micro Agent.exe, suppress the alert.

• Automated Patch Compliance Reporting

  • Scenario: The Security Operations team executes a weekly compliance report using Microsoft SCCM (Configuration Manager) task sequences that invoke Glass2k.exe to verify the integrity of installed hotfixes and driver versions before finalizing the patch status dashboard.
  • Filter/Exclusion: Filter out alerts where the file path matches the SCCM installation root: `