Disclosed hacktool set (old stuff) - file snifferport.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or repurposed hacking tools like snifferport.exe to conduct network traffic analysis and credential interception within the environment. Proactively hunting for this behavior in Azure Sentinel is critical because such “old stuff” often evades signature-based detection, allowing attackers to establish persistent footholds through overlooked file artifacts before initiating lateral movement.

YARA Rule

rule snifferport {
	meta:
		description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "d14133b5eaced9b7039048d0767c544419473144"
	strings:
		$s0 = "iphlpapi.DLL" fullword ascii
		$s5 = "ystem\\CurrentCorolSet\\" fullword ascii
		$s11 = "Port.TX" fullword ascii
		$s12 = "32Next" fullword ascii
		$s13 = "V1.2 B" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule Disclosed hacktool set (old stuff) - file snifferport.exe, along with recommended filters or exclusions:

• Scenario: Legacy Network Monitoring Agent Deployment

  • Context: The enterprise uses a legacy network performance tool (e.g., SolarWinds NPM or PRTG) that installs snifferport.exe as a background service to capture packet data on specific ports. This file often resides in C:\Program Files\SolarWinds\Network Performance Monitor\.
  • Filter/Exclusion: Create an exclusion for the specific file path and process name: Path: C:\Program Files\SolarWinds\* AND FileName: snifferport.exe. Additionally, verify the digital signature against SolarWinds Corporation.

• Scenario: Scheduled Port Scanning Maintenance Job

  • Context: A nightly scheduled task runs a custom PowerShell script or a legacy utility (e.g., Nmap wrapped in an executable) to audit open ports on the firewall. This job launches snifferport.exe from a dedicated maintenance folder, such as C:\Tools\Maintenance\.
  • Filter/Exclusion: Exclude processes launched by the Task Scheduler Service (svchost.exe) where the command line contains “Maintenance” or specific scheduled task names (e.g., TaskName: NightlyPortAudit).

• Scenario: Endpoint Detection and Response (EDR) Telemetry

  • Context: The organization’s EDR solution (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) utilizes a component named snifferport.exe to monitor network traffic for threat intelligence. This is often located in the vendor’s installation directory, such as `C:\Program Files\CrowdStrike\