Chinese Hacktool Set - file ch.exe

Hunt Hypothesis

This detection targets adversary behavior involving the execution of ch.exe, a known component of the Chinese Hacktool suite often utilized for reconnaissance and lateral movement within Windows environments. Proactively hunting for this artifact in Azure Sentinel is critical to identify early-stage supply chain compromises or persistent tooling that may be operating below standard alert thresholds despite its low severity classification.

YARA Rule

rule Dos_ch {
	meta:
		description = "Chinese Hacktool Set - file ch.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
	strings:
		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
		$s4 = "fuck,can't find WMI process PID." fullword ascii
		$s5 = "/Churraskito/-->Found token %s " fullword ascii
		$s8 = "wmiprvse.exe" fullword ascii
		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
		$s17 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 260KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file ch.exe detection rule, along with recommended filters and exclusions:

• Scenario: Legitimate Chinese Language Support Tool Execution

  • Context: In multinational enterprises with significant Chinese user bases or development teams, legitimate software often utilizes ch.exe as a component for language conversion or input method management. For instance, the Microsoft Pinyin IME (Input Method Editor) or third-party translation utilities like Youdao Dictionary may spawn this executable during startup or background synchronization.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name. Filter out alerts where ch.exe is spawned by known legitimate parents such as ctfmon.exe, TextInputHost.exe, or specific vendor executables like YoudaoDict.exe. Additionally, exclude paths located within standard application folders (e.g., C:\Program Files\Microsoft Office\... or C:\Program Files (x86)\Youdao\...).

• Scenario: Scheduled System Maintenance and Patching Jobs

  • Context: Enterprise patch management solutions often deploy custom scripts to handle regional updates. A scheduled task managed by WSUS (Windows Server Update Services) or a third-party RMM tool like ManageEngine Endpoint Central might execute ch.exe as part of a post-installation verification script for Chinese language packs. This typically occurs during maintenance windows (e.g., 2:00 AM – 4:00 AM).
  • Filter/Exclusion: Implement a filter based on the Parent Process being TaskScheduler (svchost.exe) or specific RMM agents combined with a time-based condition. Exclude alerts triggered between 01:00 and 05:00 local time where the file path contains keywords like “Updates”,