Chinese Hacktool Set - file netstat.exe

Hunt Hypothesis

This detection identifies adversaries deploying a specific Chinese hacktool suite that utilizes netstat.exe to enumerate network connections and identify active services on compromised hosts. Proactively hunting for this behavior in Azure Sentinel is critical because, despite its low severity rating, the presence of this tool often signals early reconnaissance activities by advanced persistent threat groups targeting regional infrastructure.

YARA Rule

rule Dos_netstat {
	meta:
		description = "Chinese Hacktool Set - file netstat.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
	strings:
		$s0 = "w03a2409.dll" fullword ascii
		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide  /* Goodware String - occured 2 times */
		$s2 = "Administrative Status  = %1!u!" fullword wide  /* Goodware String - occured 2 times */
		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide  /* Goodware String - occured 2 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file netstat.exe detection rule, including suggested filters and exclusions:

• Microsoft Endpoint Configuration Manager (MECM/SCCM) Software Updates

  • Scenario: During scheduled maintenance windows, SCCM agents often execute network diagnostics to verify connectivity before pushing updates. The agent may spawn a temporary netstat.exe process from the %ProgramFiles%\Microsoft Intune Management Extension\ or %SystemRoot%\System32\ directory to audit active connections and listening ports on endpoint devices.
  • Filter/Exclusion: Create an exclusion for processes where the parent process is ccmexec.exe (SCCM Agent) AND the file path matches C:\Windows\System32\netstat.exe. Additionally, verify that the file hash matches the known Microsoft-signed version of netstat.exe.

• Third-Party RMM Tools (e.g., Datto RMM or ConnectWise Automate)

  • Scenario: Remote Monitoring and Management tools frequently run automated health checks. A scheduled job named “Network Connectivity Check” might invoke netstat.exe to generate a report of open ports for compliance auditing. This is often triggered by the tool’s service process (e.g., DattoRMMService.exe) rather than user interaction.
  • Filter/Exclusion: Exclude alerts where the parent process name contains keywords like “ConnectWise,” “Datto,” or “NinjaOne” AND the execution time falls within standard business hours (08:00–18:00) on weekdays. Ensure the netstat.exe is launched with arguments typical of reporting, such as -a -n -o.

• Enterprise Antivirus Real-Time Scanning and Remediation

  • Scenario: When an EDR or AV