Disclosed hacktool set (old stuff) - file InjectT.exe

Hunt Hypothesis

This rule detects adversaries leveraging legacy or repurposed hacking tools like InjectT.exe to execute code injection attacks that may evade standard signature-based defenses. Proactively hunting for this behavior in Azure Sentinel is critical because older toolsets often lack modern security controls, making them high-value targets for attackers seeking to establish persistence through undetected process manipulation.

YARA Rule

rule WinEggDropShellFinal_zip_Folder_InjectT {
	meta:
		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
	strings:
		$s0 = "Packed by exe32pack" ascii
		$s1 = "2TInject.Dll" fullword ascii
		$s2 = "Windows Services" fullword ascii
		$s3 = "Findrst6" fullword ascii
		$s4 = "Press Any Key To Continue......" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the detection rule “Disclosed hacktool set (old stuff) - file InjectT.exe”, including suggested filters and exclusions:

• Scenario: Legacy Patch Management Deployment

  • Context: The enterprise uses an older version of Microsoft System Center Configuration Manager (SCCM) or a legacy agent like Flexera AdminStudio. During scheduled maintenance windows, these tools often deploy a utility named InjectT.exe to inject configuration updates or hotfixes into running services without requiring a full system reboot.
  • Filter/Exclusion: Add an exclusion based on the parent process name. Filter out alerts where the parent process is ccmexec.exe (SCCM) or AdminStudioAgent.exe, and restrict the file path to the standard deployment directory: C:\Program Files\Microsoft Configuration Manager\AdminConsole\Tools\.

• Scenario: Automated Endpoint Protection Health Checks

  • Context: The organization utilizes Symantec Endpoint Protection (SEP) or a similar legacy AV suite. These suites often run a background diagnostic tool named InjectT.exe as part of their “Health Check” scheduled task to verify the integrity of the injection engine and database schema consistency before daily scans begin.
  • Filter/Exclusion: Create an exclusion based on the file hash (SHA-256). Calculate the known good hash for the specific version of InjectT.exe installed in the environment and whitelist it globally, or exclude alerts where the file path matches C:\Program Files\Symantec Endpoint Protection\Tools\.

• Scenario: Third-Party Remote Support Sessions

  • Context: The IT Helpdesk utilizes a legacy remote support solution (e.g., TeamViewer 10/11 or LogMeIn Pro) that relies on InjectT.exe to inject