Chinese Hacktool Set - file sys.exe

Hunt Hypothesis

This detection identifies the presence of a known Chinese hacktool executable named sys.exe, which adversaries often deploy to establish persistence or conduct reconnaissance within compromised Azure environments. Proactively hunting for this artifact is essential because its generic filename allows it to blend into normal system activity, requiring manual verification to distinguish legitimate operations from potential stealthy threat actor behavior before escalation occurs.

YARA Rule

rule Dos_sys {
	meta:
		description = "Chinese Hacktool Set - file sys.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
	strings:
		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
		$s6 = "Author: Cyg07*2" fullword ascii
		$s12 = "from golds7n[LAG]'J" fullword ascii
		$s14 = "DAMAGE" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file sys.exe detection rule in an enterprise environment, along with recommended filters or exclusions:

Microsoft System Center Configuration Manager (SCCM) Software Updates
- Scenario: SCCM agents frequently deploy updates and run system health checks using a legitimate sys.exe binary located in the %ProgramFiles%\Microsoft Intune\Agent or %Windows%\CCMExec directories. This tool often mimics the behavior of Chinese hacktools by scanning system files and modifying registry keys to ensure compliance, triggering the alert when it accesses critical system paths.
- Filter/Exclusion: Exclude sys.exe processes where the file path starts with C:\Program Files\Microsoft Intune\Agent\ or C:\Windows\CCMExec\, and the parent process is ccmexec.exe.
Sysinternals Suite Scheduled Maintenance Jobs
- Scenario: IT administrators often schedule daily maintenance tasks using Sysinternals tools. A scheduled Task Scheduler job might execute a custom script that invokes sys.exe (a common name for internal system health checkers or wrappers around Process Explorer) to audit disk usage and service status on domain-joined servers during off-hours.
- Filter/Exclusion: Create an exclusion rule for sys.exe where the parent process is TaskScheduler (svchost.exe with specific command line arguments) AND the file hash matches a known good hash stored in your asset inventory, specifically filtering out paths under C:\Program Files\Sysinternals\.
Legacy Enterprise Backup Solutions (e.g., Veeam or Acronis)
- Scenario: Older versions of enterprise backup agents or specific Chinese-language localized versions of backup software often utilize a service executable named sys.exe to manage snapshot creation and volume