Chinese Hacktool Set - file IdtTool.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific IdtTool.exe utility associated with Chinese hacktool sets to establish persistence or conduct reconnaissance within Azure environments. Proactively hunting for this artifact is critical because its low severity classification may cause it to be overlooked in standard alerting, allowing threat actors to maintain a covert foothold before escalating their activities.

YARA Rule

rule IDTools_For_WinXP_IdtTool {
	meta:
		description = "Chinese Hacktool Set - file IdtTool.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
	strings:
		$s2 = "IdtTool.sys" fullword ascii
		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
		$s6 = "\\\\.\\slIdtTool" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 25KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file IdtTool.exe detection rule, including suggested filters and exclusions:

• Legitimate Deployment of Intel® Identity Protection Software

  • Scenario: The organization utilizes Intel’s identity management suite (often part of Intel AMT or vPro solutions) for hardware-level device authentication. The core executable IdtTool.exe is deployed via SCCM or Intune to manage cryptographic keys and secure boot configurations on endpoints.
  • Filter/Exclusion: Whitelist the file path specifically under C:\Program Files\Intel\Identity Protection\ and exclude events where the parent process is a known deployment agent (e.g., ccmexec.exe, msiexec.exe, or WinRM).

• Scheduled Maintenance by Third-Party Endpoint Security Suite

  • Scenario: An enterprise endpoint protection vendor (such as Trend Micro, Sophos, or a specialized Chinese security suite like Kingsoft Enterprise) includes IdtTool.exe as a background utility for real-time threat intelligence updates and policy synchronization. This tool runs automatically during off-hours via the Windows Task Scheduler.
  • Filter/Exclusion: Create an exclusion based on the scheduled task name (e.g., “Intel_Identity_Sync” or specific vendor maintenance tasks) and filter by the User field matching a dedicated service account (e.g., DOMAIN\svc-security-maintenance) rather than interactive user sessions.

• IT Asset Management and Inventory Scanning

  • Scenario: The IT Operations team runs periodic hardware inventory scans using tools like Lansweeper or custom PowerShell scripts that invoke IdtTool.exe to query detailed CPU, TPM, and BIOS attribute data from the Intel chipset for asset reporting.
  • Filter/Exclusion: Exclude alerts where the parent process is a known