Chinese Hacktool Set - file ms11080.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool executable ms11080.exe, which is often associated with targeted reconnaissance or lateral movement activities in environments susceptible to APTs from that region. Proactively hunting for this file within Azure Sentinel allows the SOC team to identify early-stage tooling deployments before they escalate into high-severity incidents, ensuring comprehensive coverage of low-fidelity indicators that automated rules might overlook.

YARA Rule

rule GoodToolset_ms11080 {
	meta:
		description = "Chinese Hacktool Set - file ms11080.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
	strings:
		$s1 = "[*] command add user 90sec 90sec" fullword ascii
		$s2 = "\\ms11080\\Debug\\ms11080.pdb" fullword ascii
		$s3 = "[>] by:[email protected]" fullword ascii
		$s4 = "[*] Add to Administrators success" fullword ascii
		$s5 = "[*] User has been successfully added" fullword ascii
		$s6 = "[>] ms11-08 Exploit" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 240KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file ms11080.exe detection rule, tailored for an enterprise environment:

Legacy Microsoft Office Updates via SCCM/Intune
- Scenario: The ms11080.exe executable is frequently deployed as a legacy patch installer (specifically related to the MS11-080 security update or associated Chinese language packs) by System Center Configuration Manager (SCCM) or Microsoft Intune. This often occurs during scheduled maintenance windows on endpoints running older versions of Windows 7/Server 2008 R2 that still require this specific patch chain.
- Filter/Exclusion: Create an exclusion for the process path C:\Windows\CCMCache or C:\Program Files\Microsoft Intune Management Extension executing ms11080.exe. Additionally, filter by parent process names such as ccmexec.exe, IntuneManagementExtension.exe, or WuaUspSvc.exe.
Third-Party Endpoint Protection Scans
- Scenario: Security suites like Symantec Endpoint Protection (SEP), McAfee Enterprise, or Trend Micro often include ms11080.exe within their signature database update packages. When the agent performs a scheduled “Definition Update” or “Quick Scan,” it may extract and execute this file to verify integrity or apply specific Chinese language resource updates for the console interface.
- Filter/Exclusion: Exclude events where the parent process is Symantec Endpoint Protection (e.g., ruagent.exe, rtvscan.exe) or McAfee Agent (mfeann.exe). Alternatively, filter by the specific file hash of the known legitimate ms11080.exe version used in your organization’s standard security baseline.