Disclosed hacktool set (old stuff) - file letmein.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or obfuscated hacking tools like letmein.exe to establish a foothold and potentially exfiltrate credentials within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because such “old stuff” often evades standard signature-based detections, allowing attackers to maintain persistence undetected while executing reconnaissance activities.

YARA Rule

rule sig_238_letmein {
	meta:
		description = "Disclosed hacktool set (old stuff) - file letmein.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
	strings:
		$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
		$s6 = "Error get users from server!" fullword ascii
		$s7 = "get in nt by name and null" fullword ascii
		$s16 = "get something from nt, hold by killusa." fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file letmein.exe rule, along with suggested filters and exclusions:

• Scenario: Legacy Password Management Tool Execution

  • Context: The enterprise utilizes an older version of a third-party password vault or credential manager (e.g., an on-premise deployment of BeyondTrust or Thycotic legacy agents) that installs letmein.exe as its primary launcher for the “Let Me In” feature. This file is frequently executed by helpdesk admins to grant temporary remote access to user workstations during support tickets.
  • Suggested Filter: Create an exclusion based on the specific installation path and publisher signature.
    • Path: C:\Program Files\BeyondTrust\PasswordManager\letmein.exe (or equivalent vendor path)
    • Publisher: Beyond Trust, Inc.
    • Action: Exclude if file hash matches known good baseline for version 8.x or older.

• Scenario: Scheduled Maintenance Job for Remote Access

  • Context: A nightly scheduled task (Task Scheduler ID: RemoteAccess_Maintenance) runs at 02:00 AM on all domain-joined servers to audit and refresh remote access tokens. This job invokes letmein.exe located in a custom directory (D:\Tools\Legacy\) to generate temporary RDP session keys for the overnight maintenance window.
  • Suggested Filter: Exclude based on the specific scheduled task name and execution context.
    • Scheduled Task Name: RemoteAccess_Maintenance
    • Parent Process: svchost.exe (or Task Scheduler Service)
    • Condition: Exclude if the process starts between 01:30 AM and 02:30 AM on weekdays.