Auto-generated rule - file whosthere.exe

Hunt Hypothesis

This hypothesis posits that adversaries are executing a suspicious binary named whosthere.exe to establish persistence or conduct reconnaissance within the Azure environment. The SOC team should proactively hunt for this activity because auto-generated detections often lack contextual enrichment, requiring manual verification to distinguish between legitimate administrative tools and malicious initial access vectors before they escalate into critical incidents.

YARA Rule

rule whosthere : Toolkit  {
	meta:
		description = "Auto-generated rule - file whosthere.exe"
		author = "Florian Roth"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
	strings:
		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '48.00' */
		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii /* PEStudio Blacklist: strings */ /* score: '28.00' */
		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii /* PEStudio Blacklist: strings */ /* score: '15.00' */
		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 320KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the whosthere.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Detection and Response (EDR) Agent Updates

  • Scenario: The CrowdStrike Falcon Sensor or Microsoft Defender for Endpoint performs a scheduled background update. During this process, the agent’s service executable (csfalcon.exe or MsMpEng.exe) spawns a temporary helper process named whosthere.exe to verify file integrity and network connectivity before applying patches.
  • Filter/Exclusion: Create an exclusion for whosthere.exe when the parent process is csfalcon.exe, MsMpEng.exe, or WindowsUpdate.exe. Additionally, filter out events where the file hash matches a known baseline of the vendor’s update utility.

• Identity and Access Management (IAM) Auditing Tasks

  • Scenario: A scheduled nightly job runs on the Domain Controller to audit user session activity. The script invokes whosthere.exe (part of a custom ITSM tool or a specific module from tools like BeyondTrust or CyberArk) to query active RDP sessions and generate compliance reports for “Who is there” in the network segment.
  • Filter/Exclusion: Exclude events originating from the specific Service Account used by the auditing job (e.g., svc-audit-iac) running on Domain Controllers (OU=Domain Controllers). Alternatively, filter based on the command-line arguments containing keywords like /report, /audit, or /session-check.

• Patch Management Deployment Windows

  • Scenario: During the monthly patch Tuesday window, the SCCM (System Center Configuration Manager) client executes a pre-deployment health check. It launches whosthere.exe to scan for conflicting processes and verify disk space availability before installing critical security updates across the fleet.