Auto-generated rule - file whosthere-alt.exe

Hunt Hypothesis

This hunt targets adversaries executing the suspicious binary whosthere-alt.exe, which likely indicates an initial foothold or lateral movement attempt within the Azure environment. Proactively hunting for this activity is essential to validate whether the file represents a legitimate administrative tool or a malicious payload requiring immediate containment before it escalates into a broader compromise.

YARA Rule

rule whosthere_alt : Toolkit {
	meta:
		description = "Auto-generated rule - file whosthere-alt.exe"
		author = "Florian Roth"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
	strings:
		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa ([email protected], [email protected]) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '49.00' */
		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
		$s2 = "dump output to a file, -o filename" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii /* PEStudio Blacklist: strings */ /* score: '29.00' */
		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii /* score: '24.00' */
		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
		$s6 = ".\\pth.dll" fullword ascii /* score: '16.00' */
		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 280KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific scenarios where the whosthere-alt.exe detection rule might trigger false positives in an enterprise environment, along with suggested filters or exclusions:

Scenario: Endpoint Protection Agent Health Checks
- Context: The file is likely a component of a security suite (e.g., CrowdStrike Falcon, Carbon Black, or a custom EDR agent) performing routine integrity scans or heartbeat checks. These agents often spawn whosthere-alt.exe to verify the presence and status of critical system files across the fleet without user interaction.
- Suggested Filter/Exclusion: Create an exclusion for processes spawned by known security vendor parent processes (e.g., C:\Program Files\CrowdStrike\fsagent.exe) or restrict the rule to only alert if the file hash does not match the known “Good” baseline stored in your SIEM.
Scenario: Scheduled Software Inventory and Patch Management
- Context: During off-hours (e.g., 2:00 AM – 4:00 AM), patch management tools like Microsoft SCCM, Ivanti Endpoint Manager, or Jamf Pro execute inventory scripts. whosthere-alt.exe may be invoked as a helper utility to enumerate installed applications, verify file versions, and report discrepancies back to the central console before applying updates.
- Suggested Filter/Exclusion: Implement a time-based filter to suppress alerts for this specific executable between 01:00 and 06:00 local time, or exclude execution paths located within standard software distribution directories (e.g., C:\Windows\CCM\ or C:\Program Files\Ivanti\).
Scenario: Active Directory Group Policy Object (GPO) Deployment
- Context: When a new GPO is pushed to enforce security configurations, the