Disclosed hacktool set (old stuff) - file Readme.txt

Hunt Hypothesis

This detection identifies adversaries leveraging legacy or disclosed hacking toolsets that utilize a “Readme.txt” file as an indicator of compromise, often signaling reconnaissance or initial access activities within the environment. A proactive hunt is essential in Azure Sentinel to uncover dormant threats from previously known tools that may have been reintroduced by attackers to evade standard signature-based defenses and establish persistence.

YARA Rule

rule XYZCmd_zip_Folder_Readme {
	meta:
		description = "Disclosed hacktool set (old stuff) - file Readme.txt"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
	strings:
		$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
		$s20 = "XYZCmd V1.0" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Disclosed hacktool set (old stuff) - file Readme.txt”, along with suggested filters or exclusions:

• Scenario: Developer Deployment of Legacy Documentation

  • Context: DevOps engineers frequently deploy legacy documentation packages to staging servers during CI/CD pipelines. A common practice in older repositories is to include a generic Readme.txt as part of the artifact, which may be flagged by the rule due to its filename and content structure resembling known hacktool artifacts.
  • Suggested Filter: Exclude files where the parent process is git.exe, msbuild.exe, or docker.exe running under a specific service account (e.g., svc-cicd-deploy). Additionally, filter out events occurring within designated deployment windows (e.g., 02:00–04:00 UTC).

• Scenario: Scheduled Maintenance by IT Asset Management Tools

  • Context: Enterprise asset management tools like SolarWinds Service Desk or LANDesk often run nightly inventory scans. These tools frequently generate or update a local Readme.txt in the installation directory to log version history or configuration notes, triggering the detection logic which interprets this file creation as a potential hacktool disclosure.
  • Suggested Filter: Create an exclusion for processes named SolarWinds.Agent.exe, Landesk.Agent.exe, or SCCMClient.exe. If the rule allows path-based filtering, exclude any event where the file path contains \Program Files\SolarWinds\ or \LANDesk\.

• Scenario: Automated Backup and Archiving Jobs

  • Context: Scheduled backup jobs using tools like Veeam Agent for Windows or Acronis Cyber Protect often create temporary metadata files during the archiving process. When backing up a folder