Chinese Hacktool Set - file hscan.exe

Hunt Hypothesis

This detection identifies the presence of hscan.exe, a component of the Chinese Hacktool suite often utilized by threat actors for reconnaissance and system enumeration within Azure environments. Proactively hunting for this specific artifact allows the SOC team to uncover potential early-stage adversary activity that may be missed by standard alerting due to its low severity classification, ensuring timely investigation before lateral movement occurs.

YARA Rule

rule HScan_v1_20_hscan {
	meta:
		description = "Chinese Hacktool Set - file hscan.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
	strings:
		$s1 = "[%s]: Found \"FTP account: anyone/[email protected]\"  !!!" fullword ascii
		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
		$s3 = ".\\report\\%s-%s.html" fullword ascii
		$s4 = ".\\log\\Hscan.log" fullword ascii
		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file hscan.exe detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Legitimate Endpoint Detection & Response (EDR) Scans

  • Scenario: Enterprise EDR agents (such as CrowdStrike Falcon, SentinelOne, or Trend Micro Apex One) often deploy a component named hscan.exe to perform heuristic scans, integrity checks, or host-based intrusion detection. This process may spawn during off-hours or upon policy updates, mimicking the behavior of the malicious Chinese Hacktool.
  • Filter/Exclusion: Whitelist the specific file path and publisher signature. Exclude alerts where hscan.exe is located in standard vendor directories (e.g., C:\Program Files\CrowdStrike\, C:\Trend Micro\) and the digital signer matches the known EDR vendor’s certificate (e.g., “CrowdStrike, Inc.” or “Trend Micro Incorporated”).

• Scheduled Hardware Diagnostics via Manufacturer Tools

  • Scenario: IT departments frequently deploy hardware health monitoring suites from vendors like Dell Command Update, HP System Utility, or Lenovo Vantage. These tools often utilize a utility named hscan.exe to scan for BIOS updates, memory integrity issues, or peripheral conflicts. This is commonly triggered by a scheduled Task Scheduler job (e.g., “Daily Hardware Health Check”) running under the SYSTEM or Local Service account.
  • Filter/Exclusion: Create an exclusion based on the parent process name and execution path. Filter out events where the parent process is TaskScheduler.exe or a specific manufacturer installer (e.g., DellCommandUpdate.exe) and the file hash matches the known baseline of the hardware utility version deployed across the fleet.