Auto-generated rule - file genhash.exe

Hunt Hypothesis

This detection targets adversary behavior involving the execution of genhash.exe, a utility often leveraged by attackers to generate cryptographic hashes for verifying malware integrity or establishing command-and-control trust chains within Azure environments. The SOC team should proactively hunt for this activity because its critical severity suggests potential early-stage reconnaissance or lateral movement that, if unmonitored, could indicate the deployment of sophisticated fileless attacks or supply chain compromises requiring immediate investigation.

YARA Rule

rule genhash_genhash : Toolkit  {
	meta:
		description = "Auto-generated rule - file genhash.exe"
		author = "Florian Roth"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
	strings:
		$s1 = "genhash.exe <password>" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s3 = "Password: %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii /* score: '11.00' */
		$s5 = "This tool generates LM and NT hashes." fullword ascii /* score: '10.00' */
		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii /* score: '10.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the genhash.exe detection rule in an enterprise environment, along with suggested filters:

• Microsoft Defender Antivirus Scheduled Scans

  • Scenario: The Microsoft Defender Antivirus service periodically executes a scheduled scan or on-demand quick scan. During this process, it invokes genhash.exe to calculate file integrity hashes for critical system files and recently modified documents to compare against known baselines. This is often triggered by the Task Scheduler at 2:00 AM daily across all domain-joined workstations.
  • Filter/Exclusion: Exclude events where the parent process is MsMpEng.exe (Microsoft Defender Antivirus) or TaskSchedulerService, and the execution path is within C:\ProgramData\Microsoft\Windows Defender\Platform\<Version>\.

• Sysinternals Suite Automated Integrity Monitoring

  • Scenario: Security teams deploy custom PowerShell scripts using Sysinternals tools to monitor critical application directories (e.g., SQL Server instances or Exchange databases). These scripts call genhash.exe as a utility to generate SHA-256 hashes of configuration files and binaries before and after patching cycles, logging the results for compliance auditing.
  • Filter/Exclusion: Create an exclusion rule for executions initiated by powershell.exe or specific scheduled tasks named “AppIntegrityCheck” where the command line arguments contain flags like -Algorithm SHA256 or -Path C:\Apps\.

• Endpoint Detection and Response (EDR) Agent Updates

  • Scenario: Upon receiving a new signature update package, the EDR agent (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) extracts components to a temporary directory. It utilizes genhash.exe internally to verify the integrity of the downloaded update binaries before installing them, ensuring no tampering occurred during transit