Chinese Hacktool Set - file caidao.exe

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of caidao.exe, a known Chinese hacktool often utilized for reconnaissance or initial foothold establishment within networked environments. Proactively hunting for this artifact in Azure Sentinel is critical to identify potential early-stage intrusions from state-sponsored actors, even when the associated severity is low, ensuring that benign-looking tools are not overlooked as part of a broader attack chain.

YARA Rule

rule ChinaChopper_caidao {
	meta:
		description = "Chinese Hacktool Set - file caidao.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
	strings:
		$s1 = "Pass,Config,n{)" fullword ascii
		$s2 = "phMYSQLZ" fullword ascii
		$s3 = "\\DHLP\\." fullword ascii
		$s4 = "\\dhlp\\." fullword ascii
		$s5 = "SHAutoComple" fullword ascii
		$s6 = "MainFrame" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1077KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - caidao.exe detection rule in an enterprise environment:

• Enterprise Asset Management Scans

  • Scenario: The organization utilizes a Chinese asset discovery or endpoint management suite (e.g., Tencent Cloud Security Center, Huawei eSight, or 360 Total Business) that deploys caidao.exe as a lightweight agent to perform periodic hardware inventory and software compliance checks.
  • Filter/Exclusion: Exclude the rule for processes spawned by known enterprise management parents (e.g., TencentManagerService.exe, HuaweiAgent.exe) running from standard installation directories like C:\Program Files\Tencent\ or C:\ProgramData\360\.

• Scheduled Patch Deployment Jobs

  • Scenario: A scheduled Task Scheduler job runs nightly to deploy security patches or update the Chinese HR/ERP system (common in multinational firms with APAC divisions). This job executes a custom wrapper script that launches caidao.exe to verify file integrity before applying updates.
  • Filter/Exclusion: Create an exclusion for caidao.exe when executed by the System or NT AUTHORITY\Network Service account, specifically if the command line arguments contain known job identifiers (e.g., /task:PatchVerify) and originates from a trusted path like C:\Windows\System32\Tasks\.

• Third-Party Anti-Malware Scanning

  • Scenario: The enterprise employs a secondary, specialized anti-malware layer provided by a Chinese vendor (e.g., Kingsoft Antivirus Enterprise or Qihoo 360 Security) which uses caidao.exe as its core scanning engine. This file is frequently triggered during on-demand scans