Chinese Hacktool Set - file MyUPnP.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool executable MyUPnP.exe to establish persistence or conduct network reconnaissance within Azure environments. Proactively hunting for this artifact is critical because its low severity classification may cause it to be overlooked in automated alerts, allowing attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule CN_Tools_MyUPnP {
	meta:
		description = "Chinese Hacktool Set - file MyUPnP.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
	strings:
		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
		$s2 = "myupnp.exe" fullword ascii
		$s3 = "LOADER ERROR" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1500KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file MyUPnP.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Deployment of Network Configuration Management Tools

  • Context: IT administrators frequently deploy third-party network diagnostic utilities (such as SolarWinds NPM, ManageEngine OpUtils, or custom scripts) that utilize the UPnP protocol to auto-discover and configure routers, switches, and firewalls. These tools often install a helper executable named MyUPnP.exe within their installation directory (e.g., C:\Program Files\NetworkTools\Bin\) to handle port mapping and device discovery tasks during scheduled maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion for the file path C:\Program Files\*\MyUPnP.exe where the parent process is a known management agent (e.g., SolarWindsAgent.exe, OpUtils.exe) or a legitimate service installer (msiexec.exe).

• Scenario: Automated Patch Management and Software Distribution

  • Context: Enterprise patch management solutions like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons often distribute software packages that include legacy UPnP components for remote device control. During a scheduled “Software Update” task, the distribution point may extract and execute MyUPnP.exe as part of a pre-requisite check to ensure network connectivity before applying patches to endpoints running in a DMZ or branch office environment.
  • Suggested Filter/Exclusion: Exclude execution events where the parent process is ccmexec.exe (SCCM) or IvantiAgentService.exe, and the file hash matches a known baseline version of the legitimate tool distributed by the organization’s software catalog.

• **Scenario: Virtual Desktop Infrastructure (VD