This detection identifies adversaries deploying legacy remote shell utilities like rshsvc.bat to establish persistent command-and-control channels or execute initial reconnaissance tasks within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because outdated hacktools often lack modern security controls, making them high-value targets for exploitation and potential lateral movement by threat actors.
rule sig_238_rshsvc {
meta:
description = "Disclosed hacktool set (old stuff) - file rshsvc.bat"
author = "Florian Roth"
date = "23.11.14"
score = 60
hash = "fb15c31254a21412aecff6a6c4c19304eb5e7d75"
strings:
$s0 = "if not exist %1\\rshsetup.exe goto ERROR2" fullword ascii
$s1 = "ECHO rshsetup.exe is not found in the %1 directory" fullword ascii
$s9 = "REM %1 directory must have rshsetup.exe,rshsvc.exe and rshsvc.dll" fullword ascii
$s10 = "copy %1\\rshsvc.exe" fullword ascii
$s12 = "ECHO Use \"net start rshsvc\" to start the service." fullword ascii
$s13 = "rshsetup %SystemRoot%\\system32\\rshsvc.exe %SystemRoot%\\system32\\rshsvc.dll" fullword ascii
$s18 = "pushd %SystemRoot%\\system32" fullword ascii
condition:
all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 7 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file rshsvc.bat detection rule, including suggested filters and exclusions:
Legacy Remote Support Session Initialization
rshsvc.bat as part of its service initialization script on endpoints running Windows 7/Server 2016. This batch file is executed by the system account to register the remote shell service before a user connects.vncserver.exe or TeamViewer_Service.exe and the user context is NT AUTHORITY\SYSTEM.Scheduled Maintenance Job for Database Connectivity
DB_Connectivity_Check) runs on SQL Server application servers to verify remote shell connectivity. This job invokes a custom script wrapper that calls rshsvc.bat located in the C:\Program Files\LegacyTools\Scripts\ directory to validate network ports before the main backup routine begins.C:\Program Files\LegacyTools\Scripts\rshsvc.bat when triggered by the Windows Task Scheduler service (svchost.exe with command line containing -s TaskScheduler).On-Premises RDP Gateway Deployment Script
rshsvc.bat on the target gateways to restart the RDP listener and apply new firewall rules via