Chinese Hacktool Set - file ms11046.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool executable ms11046.exe to establish persistence or conduct reconnaissance within Azure workloads. Proactively searching for this file in Azure Sentinel is critical because its low severity rating may cause it to be overlooked by automated alerts, allowing stealthy actors to maintain a foothold before triggering higher-priority incidents.

YARA Rule

rule GoodToolset_ms11046 {
	meta:
		description = "Chinese Hacktool Set - file ms11046.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
	strings:
		$s1 = "[*] Token system command" fullword ascii
		$s2 = "[*] command add user 90sec 90sec" fullword ascii
		$s3 = "[*] Add to Administrators success" fullword ascii
		$s4 = "[*] User has been successfully added" fullword ascii
		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii  /* Goodware String - occured 3 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 840KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file ms11046.exe detection rule, along with recommended filters or exclusions:

• Scenario: Microsoft Office Click-to-Run Updates

  • Context: The ms11046.exe filename is frequently used by the Microsoft Office Click-to-Run service (specifically during cumulative updates for Office 365 ProPlus) to stage installation files. In a standard enterprise environment, this process runs automatically on user workstations and servers during maintenance windows.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the parent process is OfficeClickToRun.exe (Microsoft Corporation) or SoftwareUpdateService.exe, specifically when the file path resides within %ProgramFiles%\Common Files\Microsoft Shared\Click-to-Run.

• Scenario: SCCM Application Deployment Packages

  • Context: System Center Configuration Manager (SCCM/MECM) often wraps legacy Chinese localization tools or specific vendor utilities into deployment packages. If an IT administrator deploys a localized version of a utility (e.g., a PDF converter or a hardware inventory agent) that uses ms11046.exe as its installer, the detection will trigger upon every successful installation across the domain.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (Configuration Manager) and the file hash matches known good versions of the deployed application package stored in the SCCM content library.

• Scenario: Scheduled Group Policy Software Installation

  • Context: Many enterprises utilize Group Policy Objects (GPO) to push software updates during user logon or system startup. A scheduled task named “Monthly Security Tool Update” might execute ms11046.exe from a network share (`\fileserver\software\updates