Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe

Hunt Hypothesis

This hunt targets adversaries leveraging the “Guilin Veterans Cookie Spoofing Tool” to execute session hijacking attacks by manipulating browser cookies within the Azure environment. Proactively hunting for this specific artifact allows the SOC team to identify early-stage reconnaissance or lateral movement activities that may otherwise be overlooked due to the tool’s low-severity classification.

YARA Rule

rule Guilin_veterans_cookie_spoofing_tool {
	meta:
		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
	strings:
		$s0 = "kernel32.dll^G" fullword ascii
		$s1 = "\\.Sus\"B" fullword ascii
		$s4 = "u56Load3" fullword ascii
		$s11 = "O MYTMP(iM) VALUES (" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1387KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe detection rule in an enterprise environment:

IT Asset Management Scans via Lansweeper or SCCM
- Scenario: During routine inventory cycles, endpoint management tools like Lansweeper, Microsoft SCCM (Configuration Manager), or ManageEngine Desktop Central scan all executable files on client workstations to update asset databases. These scanners often flag the Guilin veterans cookie spoofing tool.exe file simply because it exists in a user’s “Program Files” directory, even if the application is not currently running or active.
- Filter/Exclusion: Create an exclusion rule for processes originating from known IT management parent processes (e.g., LansweeperAgent.exe, ccmexec.exe, DesktopCentralAgent.exe) that are performing file enumeration actions, rather than execution or modification of the target file.
Enterprise Antivirus Real-Time Scanning
- Scenario: When a user installs or updates the legitimate “Guilin Veterans Cookie Spoofing Tool” (often used in specific regional branches for compliance), the enterprise endpoint protection suite (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender) performs an immediate deep scan of the newly created executable. The detection rule may trigger on the file creation event itself, mistaking the legitimate installation artifact for a suspicious Chinese-origin tool.
- Filter/Exclusion: Exclude the specific SHA-256 hash of the known good version of Guilin veterans cookie spoofing tool.exe from alerting when the triggering process is the antivirus engine (e.g., MsMpEng.exe, FalconSensorService.exe).
Scheduled GPO Software Deployment
- Scenario: In organizations with a specific requirement for Chinese