This hypothesis posits that adversaries are utilizing the pr.exe artifact from a known Chinese hacktool suite to establish persistence or conduct reconnaissance within the environment. The SOC team should proactively hunt for this specific file in Azure Sentinel because its low-severity classification may allow it to bypass initial alerting thresholds, enabling stealthy lateral movement before more critical indicators emerge.
rule GoodToolset_pr {
meta:
description = "Chinese Hacktool Set - file pr.exe"
author = "Florian Roth"
reference = "http://tools.zjqhr.com/"
date = "2015-06-13"
hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
strings:
$s1 = "-->Got WMI process Pid: %d " ascii
$s2 = "-->This exploit gives you a Local System shell " ascii
$s3 = "wmiprvse.exe" fullword ascii
$s4 = "Try the first %d time" fullword ascii
$s5 = "-->Build&&Change By p " ascii
$s6 = "root\\MicrosoftIISv2" fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 6 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the Chinese Hacktool Set - pr.exe detection rule in an enterprise environment, along with suggested filters or exclusions:
Scenario: Microsoft System Center Configuration Manager (SCCM) Software Updates
pr.exe (Process Monitor/Reporter) to track the installation status of software updates and patches on endpoints. This is frequently triggered during scheduled maintenance windows when agents report back to the management server.pr.exe instances where the parent process is ccmexec.exe or smstshost.exe, specifically within the path C:\Windows\CCM\ or C:\Program Files (x86)\Microsoft Configuration Manager\.Scenario: Oracle Database Patching and Health Checks
pr.exe to verify registry keys and file integrity before applying patches. This is common during automated nightly maintenance jobs managed by Oracle Enterprise Manager (OEM).pr.exe located in C:\Oracle\Middleware\ or C:\Program Files\Oracle\, where the command line arguments contain keywords like /patch, /healthcheck, or reference specific Oracle SID identifiers.Scenario: VMware vCenter Update Manager Deployments
pr.exe to pre-scan the host environment. This typically occurs when a scheduled job runs via the vSphere Client or PowerCLI scripts.pr.exe processes spawned by parent process vpxd.exe or `vmware-vcdb.exe