Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or repurposed tools like the Windows ME-era TELNET.EXE to establish covert command and control channels within the environment. Proactive hunting for this specific artifact in Azure Sentinel is critical because its outdated nature often bypasses modern signature-based defenses, allowing attackers to maintain persistent access through an overlooked vector.

YARA Rule

rule sig_238_TELNET {
	meta:
		description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
	strings:
		$s0 = "TELNET [host [port]]" fullword wide
		$s2 = "TELNET.EXE" fullword wide
		$s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
		$s14 = "Software\\Microsoft\\Telnet" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME”, along with recommended filters and exclusions:

• Legacy Remote Management via Scheduled Task

  • Scenario: An enterprise maintains a nightly scheduled task (Task Scheduler) that runs telnet.exe to verify connectivity to legacy on-premise mainframes or older IoT devices that do not support SSH. This often occurs in environments where the “Windows ME” signature is mapped to broader Windows versions for backward compatibility.
  • Filter/Exclusion: Create a rule exclusion based on the Process Command Line containing specific keywords (e.g., --verify, --ping) and restrict the trigger to run only during maintenance windows (e.g., 02:00–04:00). Alternatively, exclude the process if the parent process is svchost.exe or taskscheduler.exe.

• Administrative Scripting with PowerShell

  • Scenario: System administrators utilize PowerShell scripts to perform bulk network diagnostics. These scripts invoke telnet.exe as a child process to test port availability across a subnet of legacy servers before deploying updates, triggering the “old stuff” alert due to the executable’s age signature.
  • Filter/Exclusion: Implement an exclusion based on the Parent Process Name (powershell.exe) and the User Account. Exclude alerts where the user is part of the Domain Admins or IT_Operations security group, as these accounts are authorized to run diagnostic tools.

• Third-Party Monitoring Agent Connectivity Checks

  • Scenario: Enterprise monitoring solutions (e.g., SolarWinds, PRTG, or Nagios) installed on endpoint agents use the native Windows telnet.exe binary to perform active health checks against internal