Chinese Hacktool Set - file pc.exe

Hunt Hypothesis

This detection identifies the execution of pc.exe, a known artifact associated with Chinese hacktool sets that adversaries often deploy for reconnaissance and lateral movement within compromised networks. Proactively hunting for this specific executable in Azure Sentinel is critical to uncover early-stage intrusion activities from state-sponsored actors, even when initial alerts are flagged as low severity.

YARA Rule

rule CN_Tools_pc {
	meta:
		description = "Chinese Hacktool Set - file pc.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5cf8caba170ec461c44394f4058669d225a94285"
	strings:
		$s0 = "\\svchost.exe" fullword ascii
		$s2 = "%s%08x.001" fullword ascii
		$s3 = "Qy001Service" fullword ascii
		$s4 = "/.MIKY" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file pc.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Legitimate Process Monitoring via Process Explorer (Sysinternals)

  • Context: Administrators frequently use Microsoft Sysinternals’ Process Explorer to troubleshoot performance issues. The executable for this tool is named procexp.exe, but it often spawns child processes or interacts with a helper utility named pc.exe located in the C:\Program Files\Microsoft\Sysinternals Suite\ directory when performing deep memory scans or handle analysis.
  • Suggested Filter: Exclude files where the path contains \Sysinternals Suite\ and the parent process is procexp.exe. Additionally, verify the file hash against the known Microsoft Sysinternals signature.

• Scenario: Automated Patch Deployment with PDQ Deploy

  • Context: IT teams often utilize PDQ Deploy for enterprise software distribution. During scheduled maintenance windows (e.g., Tuesday 2 AM), the PDQ agent executes a custom script wrapper named pc.exe to check system prerequisites before installing patches on endpoints across the network. This file resides in C:\Program Files\PDQ\Deploy\Agent\.
  • Suggested Filter: Create an exclusion for files located in the C:\Program Files\PDQ\ directory where the parent process is pdqagent.exe or pdscheduler.exe, and restrict the alert to specific scheduled job times (e.g., 01:00–05:00 local time).

• Scenario: Endpoint Security Scanning with CrowdStrike Falcon

  • Context: The CrowdStrike Falcon sensor includes a component named pc.exe (Process Control) that runs periodically to scan for unauthorized process injections