Disclosed hacktool set (old stuff) - file listip.exe

Hunt Hypothesis

This rule detects adversaries deploying legacy or known malicious tools like listip.exe to establish a foothold and potentially exfiltrate data within the environment. SOC teams should proactively hunt for this behavior in Azure Sentinel because outdated hacktools often lack modern security signatures, making them ideal candidates for lateral movement and persistence that may evade standard real-time detection.

YARA Rule

rule sig_238_listip {
	meta:
		description = "Disclosed hacktool set (old stuff) - file listip.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
	strings:
		$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
		$s2 = "ERROR No.2!!! Program Terminate." fullword ascii
		$s4 = "Local Host Name: %s" fullword ascii
		$s5 = "Packed by exe32pack 1.38" fullword ascii
		$s7 = "Local Computer Name: %s" fullword ascii
		$s8 = "Local IP Adress: %s" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file listip.exe detection rule, along with recommended filters and exclusions:

• Legacy Inventory Agent Execution

  • Scenario: The enterprise utilizes an older version of a hardware/software inventory agent (e.g., SolarWinds Service Desk or Lansweeper) that relies on listip.exe to scan network interfaces and IP configurations during nightly maintenance windows. This process often launches from the C:\Program Files\InventoryAgent\bin\ directory.
  • Filter/Exclusion: Create a whitelist rule excluding processes where the Image Path matches C:\Program Files\InventoryAgent\bin\listip.exe and the Parent Process Name is the specific agent service (e.g., LansweeperService.exe).

• Scheduled Network Diagnostic Job

  • Scenario: A scheduled Windows Task configured by the Network Operations Center runs every morning at 06:00 to audit IP address assignments. This task executes a custom wrapper script that calls listip.exe located in C:\Scripts\NetworkTools\. The tool is considered “old stuff” as it was migrated from a legacy on-premise environment.
  • Filter/Exclusion: Exclude alerts where the Process Command Line contains specific flags (e.g., /audit /mode=full) and the execution time falls within the window of 05:30 to 07:30, provided the file hash matches a known good baseline for this specific tool version.

• Third-Party Endpoint Security Scanning

  • Scenario: An endpoint protection suite (such as Trend Micro or Symantec Endpoint Protection) utilizes listip.exe as a helper utility to enumerate active network connections and verify firewall