Chinese Hacktool Set - file GetPass.exe

Hunt Hypothesis

This detection identifies the presence of GetPass.exe, a known component of the Chinese Hacktool set often deployed to extract credentials and system information from endpoints. Proactively hunting for this artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked, yet its execution could indicate early-stage reconnaissance or data exfiltration by state-sponsored actors targeting sensitive identity stores.

YARA Rule

rule Dos_GetPass {
	meta:
		description = "Chinese Hacktool Set - file GetPass.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
	strings:
		$s0 = "GetLogonS" ascii
		$s3 = "/showthread.php?t=156643" ascii
		$s8 = "To Run As Administ" ascii
		$s18 = "EnableDebugPrivileg" fullword ascii
		$s19 = "sedebugnameValue" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 890KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file GetPass.exe detection rule, including suggested filters and exclusions:

• Password Management Deployment via SCCM/Intune

  • Scenario: Enterprise IT administrators deploy or update the “GetPass” password manager (often used by financial institutions) using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune. The installation package extracts GetPass.exe to a temporary folder (C:\Windows\CCMCache) before moving it to the final destination, triggering the file creation event.
  • Filter/Exclusion: Exclude file paths containing \CCMCache\, \Microsoft Intune Management Extension\, or specific installation directories like C:\Program Files (x86)\GetPass\. Additionally, filter by parent process names such as ccmexec.exe or IntuneManagementExtension.exe.

• Scheduled Credential Backup Job

  • Scenario: A scheduled Task Scheduler job runs daily at 02:00 AM to back up stored credentials. This job executes a custom PowerShell script that launches GetPass.exe in silent mode to export the vault database to a network share (e.g., \\fileserver\backups). The detection triggers on the execution of the binary during this automated window.
  • Filter/Exclusion: Create an exclusion based on the parent process being svchost.exe with the service name Schedule, or specifically filter for the command line argument containing /export or /silent. You may also exclude events occurring strictly between 01:00 and 04:00 UTC if this is a known maintenance window.

• Third-Party RMM Agent Health Check

  • Scenario: Remote Monitoring and Management (RMM) tools like SolarWinds NPM, **ManageEngine Desktop