Disclosed hacktool set (old stuff) - file xsniff.exe

Hunt Hypothesis

This detection identifies adversaries deploying legacy network sniffing tools like xsniff.exe to capture sensitive traffic and credentials within the environment. Proactive hunting for this behavior is critical in Azure Sentinel to uncover dormant reconnaissance activities that may have evaded initial automated alerts due to their reliance on older toolsets.

YARA Rule

rule sig_238_xsniff {
	meta:
		description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
	strings:
		$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
		$s3 = "%s - simple sniffer for win2000" fullword ascii
		$s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
		$s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
		$s7 = "http://www.xfocus.org" fullword ascii
		$s9 = "  -pass        : Filter username/password" fullword ascii
		$s18 = "  -udp         : Output udp packets" fullword ascii
		$s19 = "Code by glacier <[email protected]>" fullword ascii
		$s20 = "  -tcp         : Output tcp packets" fullword ascii
	condition:
		6 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file xsniff.exe detection rule, including suggested filters and exclusions:

• Legacy Network Monitoring Agent Deployment

  • Scenario: The enterprise utilizes a legacy network performance monitoring suite (e.g., SolarWinds NPM or an older version of ManageEngine OpManager) that deploys xsniff.exe as a packet capture utility on edge servers to analyze bandwidth utilization. This file is often installed in C:\Program Files\LegacyNetMonitor\bin\.
  • Suggested Filter: Exclude the specific installation path and publisher signature.
    • Filter Logic: (File.Path contains "C:\Program Files\LegacyNetMonitor") AND (Publisher equals "SolarWinds Corporation")

• Scheduled Post-Incident Forensic Collection

  • Scenario: The Security Operations Center runs a nightly scheduled task named “Nightly_Forensics_Capture” using Windows Task Scheduler. This job executes xsniff.exe to capture network traffic logs for the previous 24 hours, which are then archived in the SIEM. The tool is an older version maintained by the internal Forensics team.
  • Suggested Filter: Exclude based on the parent process and scheduled task name.
    • Filter Logic: (Parent.Process.Name equals "svchost.exe") AND (Scheduled.Task.Name contains "Nightly_Forensics_Capture")

• Third-Party Endpoint Detection & Response (EDR) Telemetry

  • Scenario: A third-party EDR solution (e.g., Trend Micro Vision One or an older build of Carbon Black) utilizes xsniff.exe as a background telemetry collector to monitor DNS queries and socket connections on workstations. This process