Disclosed hacktool set (old stuff) - file InjectT.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or disclosed hacking tools like InjectT.exe to execute process injection attacks that may evade standard signature-based defenses. Proactively hunting for this behavior in Azure Sentinel is critical because older toolsets often lack modern telemetry coverage, creating a blind spot where attackers can establish persistence and move laterally within the environment undetected.

YARA Rule

rule UnPack_rar_Folder_InjectT {
	meta:
		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
	strings:
		$s0 = "%s -Install                          -->To Install The Service" fullword ascii
		$s1 = "Explorer.exe" fullword ascii
		$s2 = "%s -Start                            -->To Start The Service" fullword ascii
		$s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
		$s4 = "The Port Is Out Of Range" fullword ascii
		$s7 = "Fail To Set The Port" fullword ascii
		$s11 = "\\psapi.dll" fullword ascii
		$s20 = "TInject.Dll" fullword ascii

		$x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
		$x2 = "injectt.exe" fullword ascii
	condition:
		( 1 of ($x*) ) and ( 3 of ($s*) )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file InjectT.exe detection rule, including targeted filters and exclusions:

• Scenario: Legacy Patch Management Deployment

  • Context: The enterprise utilizes Ivanti Neurons or Microsoft Endpoint Configuration Manager (SCCM) to deploy legacy security updates. During the nightly maintenance window, the patching engine injects a temporary executable named InjectT.exe into the memory space of critical services to apply hotfixes without requiring a full reboot.
  • Filter/Exclusion: Create an exclusion rule for files located in the specific deployment directory (e.g., C:\ProgramData\Ivanti\Deployments\) where the file hash matches the known good signature of the patching agent’s injector, and restrict this to run only during business hours or scheduled maintenance windows.

• Scenario: Antivirus Real-Time Protection Scanning

  • Context: The installed endpoint protection suite, such as CrowdStrike Falcon or Symantec Endpoint Protection, utilizes a component named InjectT.exe (often part of the “Injection Toolkit”) to perform real-time heuristic scanning. This tool injects code into running processes to detect rootkits and memory-resident threats, triggering the rule every time a user launches an application.
  • Filter/Exclusion: Exclude any process where the parent process is the primary antivirus service (e.g., FalconSensor.exe or Symantec AntiVirus.exe) and the file path resides within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).

• Scenario: Scheduled Group Policy Script Execution

  • Context: A scheduled task configured via Group Policy Preferences runs a custom PowerShell script to enforce compliance standards. This script invokes `InjectT