← Back to SOC feed Coverage →

keyfinder tool

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the execution of the KeyFinder utility, which adversaries often leverage to enumerate and extract cryptographic keys from memory or file systems during early reconnaissance phases. Proactively hunting for this activity in Azure Sentinel is critical because its low severity classification may cause it to be overlooked as benign, allowing attackers to silently gather sensitive credentials before escalating their lateral movement.

YARA Rule

rule keyfinder_tool
{
meta:
	author = "@patrickrolsen"
	reference = "Magical Jelly Bean KeyFinder"
strings:
	$s1 = "chgxp.vbs"
	$s2 = "officekey.exe"
	$s3 = "findkey.exe"
	$s4 = "xpkey.exe"
condition:
	uint16(0) == 0x5A4D and 2 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the keyfinder_tool detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/POS.yar