Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the Chinese Hacktool suite (hscan.exe and hscangui.exe) to conduct reconnaissance or establish persistence within the environment. Proactive hunting in Azure Sentinel is essential because these tools often exhibit benign characteristics that may evade standard signature-based alerts, requiring behavioral analysis to distinguish legitimate usage from covert adversary activity.

YARA Rule

rule _hscan_hscan_hscangui {
	meta:
		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
	strings:
		$s1 = ".\\log\\Hscan.log" fullword ascii
		$s2 = ".\\report\\%s-%s.html" fullword ascii
		$s3 = "[%s]: checking \"FTP account: ftp/[email protected]\" ..." fullword ascii
		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 240KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set detection rule, focusing on legitimate enterprise activities involving hscan.exe and hscangui.exe:

• Scenario: Deployment of “Huawei HiSec Insight” or “H3C SecPath” Endpoint Agents

  • Context: Many enterprises utilize Chinese cybersecurity vendors (such as Huawei, H3C, or Qihoo 360) for their endpoint detection and response (EDR) solutions. The files hscan.exe (background scanner service) and hscangui.exe (graphical user interface/management console) are core components of these legitimate suites.
  • Trigger: When the EDR agent performs a scheduled full system scan or updates its virus definition database, it spawns these processes to read file hashes and network configurations.
  • Filter/Exclusion: Create an exclusion rule based on the Publisher (e.g., “Huawei Technologies Co., Ltd.” or “H3C Technologies”) and the specific File Path (e.g., C:\Program Files\HiSec Insight\Bin\). Additionally, whitelist the process names if they are signed by a trusted Chinese Certificate Authority.

• Scenario: Execution of Third-Party Patch Management Scans

  • Context: IT administrators often deploy specialized patch management tools that bundle scanning utilities to assess system health before applying updates. Tools like “H3C IMC” (Intelligent Management Center) or custom scripts wrapping hscan.exe are common in regions with significant Chinese vendor infrastructure.
  • Trigger: A scheduled task (e.g., running every Tuesday at 02:00 AM via Windows Task Scheduler) initiates a compliance check, launching hscangui.exe to generate a report on missing patches and open ports.
  • **Filter/