Disclosed hacktool set (old stuff) - file webget.exe

Hunt Hypothesis

This detection rule identifies the execution of legacy or potentially compromised hacking tools like webget.exe, which adversaries often leverage to establish initial footholds and facilitate data exfiltration. Proactively hunting for this behavior in Azure Sentinel is critical because these older utilities frequently lack modern security controls, making them high-value targets for exploitation that could lead to undetected lateral movement within the environment.

YARA Rule

rule sig_238_webget {
	meta:
		description = "Disclosed hacktool set (old stuff) - file webget.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
	strings:
		$s0 = "Packed by exe32pack" ascii
		$s1 = "GET A HTTP/1.0" fullword ascii
		$s2 = " error " fullword ascii
		$s13 = "Downloa" ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Disclosed hacktool set (old stuff) - file webget.exe” detection rule, including recommended filters and exclusions:

• Scenario: Scheduled Webhook Data Ingestion by Monitoring Tools

  • Context: Enterprise monitoring platforms like Datadog, Splunk Universal Forwarder, or New Relic often utilize a bundled executable named webget.exe (or similar variants) to periodically pull configuration updates, metric definitions, or certificate bundles from internal repositories via HTTPS. In legacy deployments, this process may be triggered by a Windows Task Scheduler job running under the SYSTEM account during off-hours.
  • Filter/Exclusion: Create an exclusion based on the Process Path and Parent Process. Exclude alerts where webget.exe is located in specific vendor directories (e.g., C:\Program Files\Datadog\Agent\bin\webget.exe) and is spawned by a known service process like dd_agent.exe or splunkd.exe. Additionally, filter out events occurring during the defined maintenance window (e.g., 02:00–04:00).

• Scenario: Legacy Browser Update Mechanism

  • Context: Older versions of enterprise browsers, specifically legacy builds of Microsoft Edge or Google Chrome in kiosk mode, may invoke a helper process named webget.exe to download policy updates, extension manifests, or offline content packs. This often occurs when the browser is launched by an administrative script (e.g., via SCCM) rather than user interaction.
  • Filter/Exclusion: Implement a filter based on the Image Hash and Command Line. Calculate the SHA-256 hash of the legitimate webget.exe binary from a known good endpoint and whitelist this specific hash in the detection rule. Alternatively