Disclosed hacktool set (old stuff) - file nbtdump.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy NetBIOS tools like nbtdump.exe to enumerate network shares and extract sensitive data, a tactic often employed during early reconnaissance or lateral movement phases. Proactively hunting for this behavior in Azure Sentinel is critical because the use of older, potentially unmonitored utilities can indicate stealthy information gathering that may bypass standard baseline alerts, allowing attackers to map the environment before executing more complex attacks.

YARA Rule

rule sig_238_nbtdump {
	meta:
		description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
	strings:
		$s0 = "Creation of results file - \"%s\" failed." fullword ascii
		$s1 = "c:\\>nbtdump remote-machine" fullword ascii
		$s7 = "Cerberus NBTDUMP" fullword ascii
		$s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
		$s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
		$s19 = "%s's password is %s</H3>" fullword wide
		$s20 = "%s's password is blank</H3>" fullword wide
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file nbtdump.exe detection rule, along with recommended filters or exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM/MECM) Application Deployment

  • Context: The SCCM client service (ccmexec.exe) frequently launches nbtdump.exe as part of a legacy application deployment package to capture network traffic or diagnose connectivity issues during software installation. This often occurs on desktops and laptops during business hours.
  • Filter/Exclusion: Create an exclusion based on the parent process name (ccmexec.exe) and the full file path of nbtdump.exe (e.g., C:\Program Files\Microsoft Configuration Manager\AdminConsole\nbtdump.exe). Alternatively, exclude this specific hash if it is a known good artifact in your environment.

• Scenario: Scheduled Network Diagnostics Job via Task Scheduler

  • Context: A scheduled Windows Task (Task Scheduler) runs nightly to archive network logs or perform bandwidth analysis using nbtdump.exe. This task triggers automatically at 02:00 AM, often running under the context of a local system account or a dedicated service account (e.g., NT SERVICE\NetworkDiagnostics).
  • Filter/Exclusion: Exclude alerts where the parent process is svchost.exe with the specific command line containing “Task Scheduler” and the execution time falls within the maintenance window (01:00–04:00). You can also filter by the specific user context (NT AUTHORITY\SYSTEM).

• Scenario: Legacy Antivirus or Security Suite Health Check

  • Context: An older version of an enterprise antivirus suite (e.g., Symantec Endpoint Protection or McAfee) utilizes nbtdump.exe as