Chinese Hacktool Set - file MSSqlPass.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific “MSSqlPass.exe” tool from the Chinese Hacktool set to establish persistence or conduct reconnaissance within SQL environments. Proactively hunting for this artifact in Azure Sentinel is critical because its presence often indicates early-stage lateral movement by state-sponsored actors that may evade standard signature-based detection due to its low severity classification.

YARA Rule

rule MSSqlPass {
	meta:
		description = "Chinese Hacktool Set - file MSSqlPass.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
	strings:
		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
		$s1 = "empv.exe" fullword wide
		$s2 = "Enterprise Manager PassView" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 120KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file MSSqlPass.exe detection rule, including suggested filters and exclusions:

• Scenario: Legitimate SQL Server Maintenance via Third-Party Backup Tools

  • Context: Enterprise environments often use specialized backup or management suites (e.g., Veeam, Commvault, or Redgate SQL Backup) that deploy native agents to interact with the database engine. These tools frequently spawn a helper process named MSSqlPass.exe during scheduled nightly maintenance windows to handle password rotation, service restarts, or connection string validation for the MSSQL service.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name and File Hash. Filter out events where MSSqlPass.exe is spawned by known backup agents (e.g., VeeamAgent.exe, SimAgent.exe) and verify that the file hash matches the vendor-signed version.

• Scenario: Automated Password Rotation Scripts for Service Accounts

  • Context: IT Operations teams often utilize custom PowerShell or Python scripts to automate the rotation of credentials for SQL service accounts (e.g., NT SERVICE\MSSQLSERVER). These scripts may invoke a utility binary named MSSqlPass.exe located in a standard system directory (such as C:\Program Files\Microsoft SQL Server\MSSQLXX.MSSQLSERVER\Binn) to securely update the password configuration without manual intervention.
  • Filter/Exclusion: Exclude events where the File Path is within the official Microsoft installation directories (C:\Program Files\Microsoft SQL Server\*) and the User Account belongs to a dedicated service group (e.g., DOMAIN\SVC_SQL_AutoMaint or SYSTEM).

• Scenario: Deployment of Chinese-Specific ERP Modules