Chinese Hacktool Set - file xiaoa.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool xiaoa.exe to establish persistence or conduct reconnaissance within Azure Sentinel-managed endpoints. Proactively hunting for this indicator is critical because its low severity classification may cause it to be overlooked in standard alerting, yet its presence often signals early-stage activity from targeted threat actors operating in the region.

YARA Rule

rule OtherTools_xiaoa {
	meta:
		description = "Chinese Hacktool Set - file xiaoa.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
	strings:
		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
		$s2 = "The shell \"cmd\" success!" fullword ascii
		$s3 = "Not Windows NT family OS." fullword ascii /* PEStudio Blacklist: os */
		$s4 = "Unable to get kernel base address." fullword ascii
		$s5 = "run \"%s\" failed,code: %d" fullword ascii
		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file xiaoa.exe detection rule in an enterprise environment:

• Third-Party Hardware Diagnostic Suite Deployment

  • Scenario: The IT Operations team deploys a Chinese-manufactured hardware diagnostic tool (e.g., from vendors like Lenovo China, Dell China, or specialized firmware updaters for Huawei workstations) that utilizes xiaoa.exe as its primary background agent to monitor CPU health and manage driver updates.
  • Suggested Filter: Create an exclusion based on the specific File Hash (SHA-256) of the legitimate vendor’s binary, or filter by the Parent Process (e.g., msiexec.exe or a known deployment orchestrator like SCCM/MECM) when the file is located in the standard installation directory (C:\Program Files\VendorName\).

• Scheduled Enterprise Backup and Recovery Job

  • Scenario: A scheduled task runs nightly to back up critical data using a localized version of Veeam Agent for Windows or a custom Chinese cloud backup solution (e.g., Alibaba Cloud Backup agent) which executes xiaoa.exe as its engine process to handle incremental snapshots and encryption.
  • Suggested Filter: Exclude alerts where the file path matches the known backup installation directory (e.g., C:\Program Files\BackupAgent\) AND the parent process is the Windows Task Scheduler service (svchost.exe running under NetworkService or a specific scheduled task ID).

• Remote Desktop and Collaboration Client Initialization

  • Scenario: Employees in APAC regions launch the Tencent Meeting (WeChat Work) or DingTalk desktop clients, which spawn xiaoa.exe as a helper process to manage audio/video codecs