Chinese Hacktool Set - file Smartniff.exe

Hunt Hypothesis

This hunt targets adversaries deploying the Smartniff.exe network traffic analysis tool to monitor internal communications and exfiltrate sensitive data within Azure environments. Proactively hunting for this specific artifact is critical because its presence often indicates early-stage reconnaissance or persistent monitoring by threat actors utilizing Chinese-originated tooling, allowing the SOC team to validate legitimate usage versus potential stealthy surveillance before escalation occurs.

YARA Rule

rule Smartniff {
	meta:
		description = "Chinese Hacktool Set - file Smartniff.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
	strings:
		$s1 = "smsniff.exe" fullword wide
		$s2 = "[email protected]" fullword ascii
		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Smartniff.exe detection rule in an enterprise environment:

• Legacy Network Monitoring Deployment: In environments utilizing older Chinese network diagnostic suites (such as H3C Cloudi or legacy Huawei eSight agents), Smartniff.exe is often deployed on jump servers to perform packet capture and traffic analysis.

  • Filter/Exclusion: Create an exclusion for the specific file path where these tools are installed (e.g., C:\Program Files\H3C\NetworkMonitor\Smartniff.exe) or whitelist the MD5 hash of the known good binary version used by your network team.

• Scheduled System Health Audits: IT Operations teams often configure scheduled tasks to run periodic network health checks using third-party utilities like SolarWinds Engineer’s Toolset or custom scripts wrapping Smartniff.exe. These jobs typically execute during off-hours (e.g., 02:00 AM) under a dedicated service account.

  • Filter/Exclusion: Exclude alerts generated by the specific Service Account (e.g., svc-network-audit) or filter based on the Scheduled Task Name in the event metadata, ensuring only unexpected user-initiated executions trigger the alert.

• Software Installation and Patching Workflows: During mass software deployments using tools like Microsoft SCCM, Ivanti, or ManageEngine Endpoint Central, Smartniff.exe may be invoked as a pre-installation diagnostic to verify network connectivity before pushing updates to endpoints.

  • Filter/Exclusion: Implement a filter that excludes executions originating from known deployment parent processes (e.g., ccmexec.exe, IvantiAgent.exe) or restrict the rule to trigger only when the file is executed directly by interactive user sessions rather than system services.