Chinese Hacktool Set - file epathobj_exp32.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool epathobj_exp32.exe, which often indicates reconnaissance or lateral movement activities within the environment. Proactively hunting for this file in Azure Sentinel is critical to validate its legitimacy and detect potential unauthorized tool usage that may precede more significant data exfiltration or persistence attempts.

YARA Rule

rule epathobj_exp32 {
	meta:
		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
	strings:
		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
		$s1 = "Exploit ok run command" fullword ascii
		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" fullword ascii
		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 270KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set detection rule targeting epathobj_exp32.exe, along with recommended filters or exclusions:

• Scenario: Legitimate Endpoint Protection Agent Updates

  • Context: Many enterprises utilize Chinese-origin security suites (such as Kingsoft, Qihoo 360 Total Security, or Tencent PC Manager) for specific regional offices or contractor laptops. These agents frequently deploy a component named epathobj_exp32.exe to handle real-time file path monitoring and heuristic scanning during scheduled maintenance windows.
  • Filter/Exclusion: Create an exclusion rule based on the File Hash (SHA-256) of the known good version of the agent, or exclude the process if its parent process is Qihoo360.exe or KingsoftAntivirusService.exe.

• Scenario: IT Asset Management and Inventory Scanning

  • Context: System administrators often deploy inventory tools like Lansweeper, SolarWinds RMM, or custom PowerShell scripts wrapped in an executable to audit hardware. In environments with significant Chinese vendor integration, these tools may invoke epathobj_exp32.exe as a helper utility to enumerate file system objects and registry keys for compliance reporting.
  • Filter/Exclusion: Exclude alerts where the User Account is a dedicated service account (e.g., svc-inventory-scanner) or restrict the rule to only trigger on non-standard directories, excluding paths like C:\Program Files\Lansweeper\Agents.

• Scenario: Scheduled Group Policy Software Deployment

  • Context: During automated patch management cycles using tools like Microsoft SCCM (ConfigMgr) or Ivanti Endpoint Manager, a deployment package may extract and execute epathobj_exp32.exe to configure local security