Chinese Hacktool Set - file NtGod.exe

Hunt Hypothesis

This hunt targets adversaries deploying the NtGod.exe reconnaissance tool to enumerate system configurations and network topology within Azure Sentinel environments. Proactively searching for this artifact is critical because its presence often signals early-stage Chinese threat actor activity that may precede more aggressive data exfiltration or lateral movement campaigns.

YARA Rule

rule Dos_NtGod {
	meta:
		description = "Chinese Hacktool Set - file NtGod.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
	strings:
		$s0 = "\\temp\\NtGodMode.exe" ascii
		$s4 = "NtGodMode.exe" fullword ascii
		$s10 = "ntgod.bat" fullword ascii
		$s19 = "sfxcmd" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 250KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file NtGod.exe detection rule in an enterprise environment:

• IT Asset Management & Remote Support Sessions

  • Scenario: The IT Helpdesk utilizes TeamViewer, AnyDesk, or Splashtop for remote troubleshooting. These tools often spawn a background process named NtGod.exe (or similar variants) to manage network connectivity, firewall exceptions, and session recording on Windows endpoints. This is particularly common in environments where the support tool is installed via Group Policy.
  • Suggested Filter: Exclude NtGod.exe when the parent process is one of the known remote support executables (e.g., TeamViewer_Service.exe, AnyDesk.exe, SplashtopAgent.exe) and the file path resides in the vendor’s standard installation directory (e.g., C:\Program Files\TeamViewer\).

• Automated Patch Management & Compliance Scans

  • Scenario: Enterprise patch management solutions like Ivanti, ManageEngine Endpoint Central, or SolarWinds Patch Manager utilize a component named NtGod.exe to perform deep system scans, registry cleanup, and driver updates during scheduled maintenance windows. This process may trigger the rule when it accesses sensitive system files or modifies security policies as part of its routine compliance check.
  • Suggested Filter: Create an exclusion based on the Scheduled Task name (e.g., Task: Ivanti_Patch_Scan or Task: EndpointComplianceCheck) and restrict the alert to only trigger if the execution time falls outside standard business hours (e.g., 02:00 – 05:00) for non-interactive user sessions.

• Third-Party Antivirus & EDR Heuristic Scans *