Semi-Auto-generated - file h4ntu shell [powered by tsoi].txt

Hunt Hypothesis

This detection targets adversaries executing obfuscated or semi-automated shell scripts with suspicious naming conventions to establish persistence and execute malicious payloads within Azure Sentinel. A proactive hunt is essential because such files often indicate early-stage lateral movement or command-and-control communication that may evade standard signature-based defenses due to their dynamic generation patterns.

YARA Rule

rule WEBSHELL_H4ntu_Shell_Powered_Tsoi {
   meta:
      description = "Semi-Auto-generated - file h4ntu shell [powered by tsoi].txt"
      author = "Florian Roth"
      date = "2014-03-29"
      modified = "2025-03-21"
      score = 80
      old_rule_name = "Webshell_h4ntu_shell__powered_by_tsoi_"
      hash = "06ed0b2398f8096f1bebf092d0526137"
      id = "81a017e8-96e4-53c6-a11e-0a11ded13287"
   strings:
      $x1 = "<title>h4ntu shell"
      $x2 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"
   condition:
      filesize < 100KB
      and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the detection rule “Semi-Auto-generated - file h4ntu shell [powered by tsoi].txt”, along with targeted filters and exclusions:

• Scenario: Scheduled Backup Script Execution

  • Context: A nightly backup job executed via Windows Task Scheduler or a Linux Cron job uses a PowerShell script named h4ntu_shell.ps1 (or similar) to generate a status log file. The process creates the .txt artifact in a dedicated logging directory as part of standard maintenance.
  • Filter/Exclusion: Exclude alerts where the Process Name matches powershell.exe or cron and the File Path contains \Logs\Backup\ or /var/log/backup/. Additionally, filter by User Account to include only service accounts (e.g., DOMAIN\svc-backup-agent).

• Scenario: SIEM Log Ingestion from Third-Party Agents

  • Context: A third-party security agent (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) running on the endpoint periodically writes a diagnostic report file named h4ntu_shell [powered by tsoi].txt to a temporary cache folder during its health check routine. This is a known artifact of the agent’s “Tsoi” module.
  • Filter/Exclusion: Create an exclusion rule based on the Parent Process Name (e.g., Cns.exe, DefenderService.exe) and restrict the File Path to specific vendor directories like C:\Program Files\CrowdStrike\ or /opt/crowdstrike/logs.

• Scenario: Automated Compliance Reporting Job

  • Context: An internal compliance automation tool (e.g., a custom Python script running via Ansible Tower) generates daily audit reports. The script