This detection identifies adversaries deploying legacy hacking tools, specifically the TBack.DLL component, which often indicates a post-compromise phase where attackers establish persistence or prepare for lateral movement. Proactively hunting for this artifact in Azure Sentinel is critical to uncover dormant threats that may have evaded initial defenses by utilizing older, less scrutinized tooling within the environment.
rule UnPack_rar_Folder_TBack {
meta:
description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
author = "Florian Roth"
date = "23.11.14"
score = 60
hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
strings:
$s0 = "Redirect SPort RemoteHost RPort -->Port Redirector" fullword ascii
$s1 = "http://IP/a.exe a.exe -->Download A File" fullword ascii
$s2 = "StopSniffer -->Stop Pass Sniffer" fullword ascii
$s3 = "TerminalPort Port -->Set New Terminal Port" fullword ascii
$s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
$s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
$s7 = "StartSniffer NIC -->Start Sniffer" fullword ascii
$s8 = "Shell -->Get A Shell" fullword ascii
$s11 = "DeleteService ServiceName -->Delete A Service" fullword ascii
$s12 = "Disconnect ThreadNumber|All -->Disconnect Others" fullword ascii
$s13 = "Online -->List All Connected IP" fullword ascii
$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
$s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
$s18 = "Execute Program -->Execute A Program" fullword ascii
$s19 = "Reboot -->Reboot The System" fullword ascii
$s20 = "Password Sniffering Is Not Running" fullword ascii
condition:
4 of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 16 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file TBack.DLL detection rule, including suggested filters and exclusions:
Legacy Backup Agent Execution
TBack.DLL (Time Back) within the backup service directory to handle incremental snapshot logic. This file is loaded by the vbrservice.exe process during scheduled nightly backup windows, triggering the rule due to its “old stuff” signature hash.C:\Program Files\Veeam\Backup and Replication\Tools\TBack.DLL. Additionally, filter alerts where the parent process is vbrservice.exe or commvault.exe running under the SYSTEM account.Scheduled Maintenance Job on Terminal Services
TBack.DLL from the C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temp directory to manage temporary file cleanup and registry restoration, mimicking hacktool behavior.\Framework\v4.0.30319\ AND the parent process is TaskScheduler.exe. Implement a time-based filter to suppress alerts during the defined maintenance window (e.g., 02:00 – 04:00 UTC).Antivirus Real-Time Scanning of Legacy Applications