Chinese Hacktool Set - file SwitchSniffer.exe

Hunt Hypothesis

This hunt targets the presence of SwitchSniffer.exe, a known Chinese hacktool often associated with network traffic monitoring and potential data exfiltration activities. Proactively searching for this artifact in Azure Sentinel allows the SOC team to identify early-stage reconnaissance or persistent surveillance tools that may operate below standard alert thresholds before escalating to more severe incidents.

YARA Rule

rule SwitchSniffer {
	meta:
		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
	strings:
		$s0 = "NextSecurity.NET" fullword wide
		$s2 = "SwitchSniffer Setup" fullword wide
	condition:
		uint16(0) == 0x5a4d and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file SwitchSniffer.exe detection rule, along with recommended filters or exclusions:

• Scenario: Legitimate Network Traffic Analysis via SolarWinds NPM

  • Context: The enterprise uses SolarWinds Network Performance Monitor (NPM) which deploys the SwitchSniffer.exe agent on Windows servers to capture packet data for bandwidth analysis and troubleshooting. This is a standard administrative task, not malicious behavior.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the file path matches C:\Program Files\SolarWinds\Network Performance Monitor\SwitchSniffer.exe AND the parent process is SolarWindsAgentService.exe.

• Scenario: Scheduled Maintenance Job for Cisco DNA Center Integration

  • Context: A nightly scheduled task (Task Scheduler) runs a custom script to synchronize switch configurations with Cisco DNA Center. This job executes SwitchSniffer.exe located in the shared network drive (\\FileServer\NetworkTools\) to validate VLAN tagging before pushing updates.
  • Filter/Exclusion: Exclude alerts where the file hash matches the known good SHA-256 of the Cisco tool, and the execution time falls within the maintenance window (e.g., 02:00 – 04:00 UTC), specifically when triggered by System or NetworkAdmin accounts.

• Scenario: Deployment of Third-Party Endpoint Detection and Response (EDR) Scanner

  • Context: The organization utilizes a specialized Chinese-origin EDR solution, such as Trend Micro Deep Security or Huawei CloudEngine, which includes a module named SwitchSniffer.exe for deep packet inspection on virtualized hosts. This file is frequently updated and executed by the central management console.