Chinese Hacktool Set - file sekurlsa.dll

Hunt Hypothesis

This hunt targets adversaries deploying the Chinese Hacktool Set by monitoring for the presence of the specific sekurlsa.dll file, which is often used to manipulate authentication processes and extract credentials. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify early-stage reconnaissance or lateral movement activities before they escalate into critical incidents, even though the initial alert severity is low.

YARA Rule

rule sekurlsa {
	meta:
		description = "Chinese Hacktool Set - file sekurlsa.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
		$s4 = "Injection de donn" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file sekurlsa.dll detection rule, including suggested filters and exclusions:

• Windows Security Center Updates via Microsoft Update Agent

  • Scenario: The Windows Update service (wuauserv) or the Background Intelligent Transfer Service (BITS) downloads and extracts a security patch that updates core authentication libraries. During this process, svchost.exe or msiexec.exe may write to or load sekurlsa.dll in the %SystemRoot%\System32\wbem or %SystemRoot%\System32 directory as part of a routine maintenance task.
  • Filter/Exclusion: Exclude file paths where the parent process is svchost.exe with the command line containing -k netsvcs or -k wuauserv, specifically when the file path matches %WINDIR%\System32\sekurlsa.dll.

• Endpoint Protection Scans by CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon Sensor (CSFalconService.exe) performs a real-time scan or on-demand full system audit. As part of its kernel-level scanning engine, it loads and inspects sekurlsa.dll to verify the integrity of the Local Security Authority (LSA) subsystem, triggering the detection logic without malicious intent.
  • Filter/Exclusion: Create an exclusion rule for parent process names matching CSFalconService.exe, CrowdStrike Falcon Service, or csfalcon.exe when accessing files within %WINDIR%\System32.

• Scheduled Group Policy Updates via GPMC

  • Scenario: A scheduled Group Policy refresh (triggered by the gpsvc service) applies security settings that require re-loading of LSA components. The process `gpupdate.exe