Chinese Hacktool Set - file Generate.exe

Hunt Hypothesis

This detection identifies the execution of “Generate.exe,” a known artifact associated with Chinese hacktools that often serves as an initial foothold for reconnaissance or payload delivery within the environment. Proactively hunting for this behavior in Azure Sentinel is critical to validate whether these legitimate utility files are being leveraged by adversaries to establish persistence before escalating their attack chain.

YARA Rule

rule Generate {
	meta:
		description = "Chinese Hacktool Set - file Generate.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
	strings:
		$s1 = "C:\\TEMP\\" fullword ascii
		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
		$s3 = "$530 Please login with USER and PASS." fullword ascii
		$s4 = "_Shell.exe" fullword ascii
		$s5 = "ftpcWaitingPassword" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file Generate.exe detection rule, tailored for an enterprise environment:

• Scenario: Microsoft Office Deployment Toolkit (ODT) Execution

  • Context: The Generate.exe binary is frequently used by the Microsoft Office Deployment Tool to generate configuration XML files or install updates during scheduled maintenance windows. This often occurs on user workstations when IT pushes new Office versions via SCCM or Intune.
  • Filter/Exclusion: Exclude processes where the parent process is OfficeDeploymentTool.exe (or msiexec.exe) and the file path resides within the standard Microsoft installation directory, specifically C:\Program Files\Microsoft Office\Root\Office\.

• Scenario: Visual Studio Build and Deployment Pipelines

  • Context: In development environments, build agents often utilize a generic Generate.exe utility (sometimes part of third-party CI/CD plugins or internal DevOps tooling) to generate code artifacts, documentation, or deployment manifests. This is common on servers running Jenkins, Azure DevOps agents, or GitHub Actions runners.
  • Filter/Exclusion: Create an exclusion for Generate.exe located in the build agent’s working directory (e.g., C:\Program Files\Microsoft Visual Studio\..., D:\BuildAgents\...) where the process owner is a service account (e.g., NT AUTHORITY\SYSTEM, DEV-BUILD-SVC).

• Scenario: Enterprise Antivirus or EDR Policy Updates

  • Context: Certain Endpoint Detection and Response (EDR) suites, particularly those with Chinese origins or specific modules for threat intelligence generation, may spawn a helper executable named Generate.exe to create local policy definitions or update signature databases silently in the background.
  • Filter/Exclusion: Whitelist `Generate