This hunt targets adversaries deploying the specific IdtTool.sys driver associated with Chinese hacktool suites to establish persistence or conduct system reconnaissance within Azure environments. Proactively hunting for this artifact is critical because its presence often indicates a targeted supply chain compromise or advanced persistent threat that may bypass standard signature-based detections due to its low-severity classification.
rule IDTools_For_WinXP_IdtTool_2 {
meta:
description = "Chinese Hacktool Set - file IdtTool.sys"
author = "Florian Roth"
reference = "http://tools.zjqhr.com/"
date = "2015-06-13"
hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
strings:
$s0 = "\\Device\\devIdtTool" fullword wide
$s1 = "IoDeleteSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
$s3 = "IoDeleteDevice" fullword ascii /* Goodware String - occured 993 times */
$s6 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
$s7 = "IoCreateDevice" fullword ascii /* Goodware String - occured 988 times */
condition:
uint16(0) == 0x5a4d and filesize < 7KB and all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 5 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file IdtTool.sys detection rule, including suggested filters and exclusions:
Legitimate Deployment of IDT Audio Drivers via Endpoint Management
IdtHighDefAudioCodec or similar) to workstations using tools like Microsoft SCCM, Ivanti, or Jamf. The installation process writes the IdtTool.sys driver file to %SystemRoot%\System32\drivers, triggering the detection.C:\Windows\System32\drivers) where the parent process is a known deployment agent (e.g., ccmexec.exe for SCCM, IvAntAgent.exe, or JamfProHelper). Additionally, verify the file hash against the official IDT vendor signature.Scheduled Maintenance Task for Audio Diagnostics
IdtTool.sys driver dynamically to query device status, causing the file access event.svchost.exe with the specific service name AudioEndpointBuilder, or TaskSchedulerService) running during defined maintenance windows (e.g., 02:00–04:00 local time).Virtual Desktop Infrastructure (VDI) Provisioning