Disclosed hacktool set (old stuff) - file superscan3.0.exe

Hunt Hypothesis

This detection identifies adversaries leveraging legacy or repurposed hacking tools like SuperScan 3.0 to conduct network reconnaissance and vulnerability scanning within the environment. Proactive hunting for this behavior in Azure Sentinel is critical because outdated security utilities often lack modern signatures, making them ideal candidates for lateral movement and initial foothold establishment by threat actors.

YARA Rule

rule superscan3_0 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
	strings:
		$s0 = "\\scanner.ini" fullword ascii
		$s1 = "\\scanner.exe" fullword ascii
		$s2 = "\\scanner.lst" fullword ascii
		$s4 = "\\hensss.lst" fullword ascii
		$s5 = "STUB32.EXE" fullword wide
		$s6 = "STUB.EXE" fullword wide
		$s8 = "\\ws2check.exe" fullword ascii
		$s9 = "\\trojans.lst" fullword ascii
		$s10 = "1996 InstallShield Software Corporation" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file superscan3.0.exe detection rule, including suggested filters and exclusions:

• Legacy Endpoint Security Maintenance Job

  • Scenario: The enterprise utilizes a legacy endpoint protection suite (e.g., Trend Micro or older Symantec versions) that includes “SuperScan” as a standalone remediation utility. A nightly scheduled task (Task Scheduler) runs superscan3.0.exe on all workstations at 2:00 AM to perform deep heuristic scans and quarantine old malware definitions before the main engine updates.
  • Filter/Exclusion: Create an exclusion based on the Process Name (superscan3.0.exe) combined with a specific User Context (e.g., SYSTEM or a dedicated service account like svc_antivirus). Additionally, filter by File Path, ensuring the executable resides in a trusted directory such as C:\Program Files\Trend Micro\SuperScan\.

• IT Helpdesk Remote Remediation Tool

  • Scenario: The IT Helpdesk team uses a remote management console (e.g., Ivanti or SCCM) to push on-demand security scans to user machines. When an agent is deployed to a specific workstation to resolve a “suspected infection” ticket, the technician manually launches superscan3.0.exe from a known network share (\\fileserver\tools\security\) to generate a detailed report for the user.
  • Filter/Exclusion: Exclude events where the Parent Process is a known remote management agent (e.g., ccmexec.exe, ivanti_agent.exe, or rdpclip.exe if launched via RDP). Alternatively, filter by Source IP, allowing traffic originating from the internal Helpdesk VLAN subnet.