Chinese Hacktool Set - file KiwiTaskmgr.exe

Hunt Hypothesis

This hunt targets adversaries deploying the Chinese Hacktool suite by identifying the presence of the KiwiTaskmgr.exe executable, which is often utilized for credential harvesting and task management during initial access phases. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to detect low-severity, stealthy reconnaissance activities that may precede more critical lateral movement or data exfiltration events within the cloud environment.

YARA Rule

rule KiwiTaskmgr_2 {
	meta:
		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
	strings:
		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
		$s3 = "KiwiAndTaskMgr" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file KiwiTaskmgr.exe detection rule, tailored for an enterprise environment:

• Scheduled Maintenance via Task Scheduler

  • Scenario: System administrators utilize KiwiTaskMgr (part of the Kiwi SysAdmin Suite) to manage complex scheduled tasks that standard Windows Task Scheduler cannot handle efficiently. A legitimate job is triggered during off-hours (e.g., 02:00 AM) on a Domain Controller or File Server, executing KiwiTaskmgr.exe to perform log rotation and service restarts.
  • Filter/Exclusion: Create an exclusion based on the Parent Process being svchost.exe (specifically the Schedule service) or taskeng.exe, combined with a User Account filter for known Service Accounts (e.g., svc_taskmgr) running in the System context.

• Endpoint Management Agent Deployment

  • Scenario: The IT Operations team deploys KiwiTaskMgr as part of a broader endpoint management solution to standardize task scheduling across 50+ workstations. During a patch Tuesday deployment, the software installation package extracts and runs KiwiTaskmgr.exe to configure local user tasks for application updates.
  • Filter/Exclusion: Exclude files located in specific enterprise-standard directories (e.g., C:\Program Files\KiwiSysAdmin\TaskMgr\) where the file hash matches a known “Good” baseline, and restrict alerts to only trigger if the process is running outside of standard business hours or from non-admin user sessions.

• Third-Party Backup Software Integration

  • Scenario: An enterprise backup solution (such as Veeam or Commvault) integrates KiwiTaskMgr to handle pre-backup cleanup scripts and post-backup verification tasks