Chinese Hacktool Set - file fp.exe

Hunt Hypothesis

This detection identifies the execution of fp.exe, a known artifact from the Chinese Hacktool set often associated with reconnaissance and lateral movement activities within enterprise networks. Proactively hunting for this specific file in Azure Sentinel is critical to uncover early-stage adversary presence that may evade standard alerting thresholds due to its low severity classification, ensuring timely investigation before potential data exfiltration occurs.

YARA Rule

rule Dos_fp {
	meta:
		description = "Chinese Hacktool Set - file fp.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
	strings:
		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
		$s2 = "FPipe.exe" fullword wide
		$s3 = "http://www.foundstone.com" fullword ascii
		$s4 = "%s %s port %d. Address is already in use" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 65KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file fp.exe detection rule, tailored for an enterprise environment:

• Fortinet Endpoint Security Updates

  • Scenario: The Fortinet endpoint agent (common in enterprises using FortiClient) frequently extracts or executes a temporary component named fp.exe during policy updates or real-time scan initialization. This file often resides in the installation directory (C:\Program Files\Fortinet\...) and is signed by “Fortinet, Inc.”
  • Filter/Exclusion: Exclude files where the path contains \Fortinet\, the publisher is Fortinet, Inc., and the digital signature status is valid.

• F5 BIG-IP License and Configuration Tools

  • Scenario: In data centers utilizing F5 load balancers or BIG-IP appliances, the administration suite often deploys a utility named fp.exe (F5 Provisioning) to manage license keys or push configuration changes from a central management server. This is typically triggered by scheduled maintenance jobs running under the SYSTEM account.
  • Filter/Exclusion: Create an exclusion for fp.exe located in \F5\, executed by the SYSTEM user, and associated with process names like tmsh or f5-provision.

• HP Firmware Update Utilities

  • Scenario: Organizations using HP hardware often deploy the “HP Firmware Update” tool across endpoints. This utility utilizes a component named fp.exe (Firmware Processor) to check for and apply BIOS/UEFI updates during off-hours maintenance windows. The file is usually found in C:\Program Files\Hewlett-Packard\....
  • Filter/Exclusion: Exclude fp.exe instances where the parent process is hpwuagent.exe or `HPUpdate