Chinese Hacktool Set - file SqlDbx_zhs.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool SqlDbx_zhs.exe to establish persistence or conduct reconnaissance within the environment. Proactively searching for this artifact in Azure Sentinel is critical because its presence may indicate early-stage supply chain compromise or targeted espionage activity that requires immediate validation despite its low initial severity rating.

YARA Rule

rule SqlDbx_zhs {
	meta:
		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
	strings:
		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
		$s12 = "mailto:[email protected]" fullword ascii
		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
	condition:
		uint16(0) == 0x5a4d and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - SqlDbx_zhs.exe detection rule in an enterprise environment:

• Legacy Database Administration on Windows Servers

  • Scenario: System administrators or DBAs utilize older versions of Navicat Premium (Chinese Edition) or DBeaver with Chinese locale plugins to manage SQL Server, MySQL, or Oracle instances. The SqlDbx_zhs.exe process often launches as a background helper service when connecting to databases, particularly during routine schema migrations or bulk data imports performed by the IT operations team.
  • Filter/Exclusion: Create an exclusion for the specific file path where the tool is installed (e.g., C:\Program Files\Navicat Premium 12\SqlDbx_zhs.exe) and restrict the alert to only trigger if the process parent is not a known administrative user account or a scheduled task service.

• Automated Reporting via Scheduled Tasks

  • Scenario: A finance department runs an automated nightly job using Microsoft Task Scheduler to generate end-of-day transaction reports. This job invokes SqlDbx_zhs.exe as a CLI wrapper to query the ERP database and export results to CSV/Excel formats. The process executes under a dedicated service account (e.g., svc_finance_report) rather than an interactive user session, mimicking the behavior of a legitimate scheduled maintenance script.
  • Filter/Exclusion: Exclude alerts where the parent process is Taskeng.exe or svchost.exe and the running user account matches known service accounts (e.g., svc_*, domain_admins). Additionally, filter by the specific command-line arguments that indicate a batch mode execution (e.g., containing flags like -batch, -export, or -silent).

• Third-Party Data Integration Middleware *