Chinese Hacktool Set - file mswin_check_lm_group.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the specific Chinese hacktool mswin_check_lm_group.exe to establish persistence or conduct local reconnaissance within Windows environments. Proactive hunting in Azure Sentinel is essential because this low-severity indicator often represents an early-stage footprint of advanced persistent threats targeting regional infrastructure, requiring correlation with other behavioral signals before it escalates into a critical incident.

YARA Rule

rule mswin_check_lm_group {
	meta:
		description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
	strings:
		$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
		$s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
		$s3 = "-D    default user Domain" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 380KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - mswin_check_lm_group.exe detection rule, tailored for an enterprise environment:

• Scenario: Microsoft Endpoint Configuration Manager (MECM/SCCM) Compliance Scanning

  • Context: The SCCM client service periodically executes local maintenance scripts to verify Local Group Policy settings and user group memberships. In environments using Chinese-language OS images or localized SCCM packages, the scanner may spawn mswin_check_lm_group.exe as part of a “Local Machine Check” task to validate domain join status.
  • Filter/Exclusion: Create an exclusion for processes spawned by the parent process ccmexec.exe (SCCM Agent) or specifically target files located in the path C:\Program Files\Microsoft Configuration Manager\Client\.

• Scenario: Third-Party Patch Management Suite (e.g., Ivanti or ManageEngine)

  • Context: Enterprise patch management tools often run pre-deployment checks to ensure system readiness. When scanning for “Local Security Policy” compliance on Chinese Windows 10/11 endpoints, these agents may utilize a helper utility named mswin_check_lm_group.exe to enumerate local groups before applying security updates.
  • Filter/Exclusion: Exclude the file hash of this specific executable when the parent process is identified as IvantiAgent.exe, ZAPService.exe (ManageEngine), or any known patch management service running under a dedicated service account (e.g., DOMAIN\PatchSvc).

• Scenario: Scheduled Group Policy Refresh and Audit Jobs

  • Context: IT administrators often deploy scheduled tasks via GPO to audit local group configurations across the fleet. A custom PowerShell script or batch job named “LM_Group_Audit” may be configured to run daily at 02:00 AM, invoking `mswin