Chinese Hacktool Set - file s.exe

Hunt Hypothesis

This detection rule identifies the execution of s.exe, a known artifact associated with Chinese hacktool sets that adversaries often deploy to establish initial footholds or conduct reconnaissance within Azure environments. Proactively hunting for this specific file is critical because its low severity classification may cause it to be overlooked in standard alerting, allowing threat actors to maintain persistent access before escalating their activities.

YARA Rule

rule S_MultiFunction_Scanners_s {
	meta:
		description = "Chinese Hacktool Set - file s.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
	strings:
		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
		$s5 = "Failed to read file or invalid data in file!" fullword ascii
		$s6 = "www.hackdos.com" fullword ascii
		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
		$s11 = "The interface of kernel library is invalid!" fullword ascii
		$s12 = "eventvwr" fullword ascii
		$s13 = "Failed to decompress data!" fullword ascii
		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 8000KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file s.exe detection rule in an enterprise environment:

• Scheduled System Health Monitoring via Sysinternals Suite

  • Scenario: The IT Operations team utilizes a scheduled task (Task Scheduler) to run s.exe (a custom wrapper script or a renamed instance of Microsoft’s Sysinternals Process Explorer) during off-hours to audit running processes and handle memory leaks. Because the file name is generic (s.exe) and it executes with administrative privileges, it mimics the behavior of Chinese hacktools which often use short, single-letter executable names to blend in.
  • Suggested Filter: Create an exclusion based on the File Hash (SHA-256) of the legitimate s.exe binary or filter by Parent Process ID, ensuring the parent is specifically TaskScheduler.exe (svchost.exe) rather than a browser or generic user process.

• Deployment of Custom Patch Management Agents

  • Scenario: A third-party patch management solution, such as Ivanti Endpoint Manager or ManageEngine Desktop Central, deploys a lightweight update agent named s.exe to scan for software vulnerabilities and install patches on endpoints. This agent frequently drops files into the %ProgramData% directory and executes with elevated rights, triggering the rule due to the file’s origin and execution pattern resembling known Chinese tooling behaviors.
  • Suggested Filter: Exclude events where the File Path matches the specific vendor installation directory (e.g., C:\Program Files\Ivanti\Agent\s.exe) or filter by Publisher Name if the binary is digitally signed by the vendor (e.g., “Ivanti Inc.”).

• Automated Backup and Snapshot Utilities

  • Scenario: The organization uses a custom internal backup utility named `s