Chinese Hacktool Set - file termsrv.dll

Hunt Hypothesis

This detection identifies the presence of termsrv.dll, a component associated with Chinese-origin hacktools that may indicate reconnaissance or lateral movement activities within the environment. Proactively hunting for this artifact in Azure Sentinel is critical to uncover potential supply chain compromises or unauthorized remote access mechanisms before they escalate into higher-severity incidents.

YARA Rule

rule Tools_termsrv {
	meta:
		description = "Chinese Hacktool Set - file termsrv.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "294a693d252f8f4c85ad92ee8c618cebd94ef247"
	strings:
		$s1 = "Iv\\SmSsWinStationApiPort" fullword ascii
		$s2 = " TSInternetUser " fullword wide
		$s3 = "KvInterlockedCompareExchange" fullword ascii
		$s4 = " WINS/DNS " fullword wide
		$s5 = "winerror=%1" fullword wide
		$s6 = "TermService " fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1150KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file termsrv.dll detection rule in an enterprise environment:

• Microsoft Terminal Services Licensing Deployment

  • Scenario: During a routine patching cycle or new server provisioning, the System Center Configuration Manager (SCCM) deploys the Microsoft Terminal Services Licensing service. This process involves copying and registering termsrv.dll within the %SystemRoot%\System32 directory to manage RDP session limits.
  • Filter/Exclusion: Exclude file creation or modification events where the parent process is ccmexec.exe (SCCM) or msiexec.exe, specifically targeting files located in C:\Windows\System32\termsrv.dll.

• Third-Party RDP Management Suite Installation

  • Scenario: The IT Operations team installs or updates a remote management suite like SolarWinds Server & Application Monitor (SAM) or Ivanti Endpoint Manager. These tools often inject or update termsrv.dll to enhance their own Remote Desktop Protocol monitoring capabilities and session auditing features.
  • Filter/Exclusion: Create an exclusion for file operations on termsrv.dll initiated by known management binaries such as SolarWinds.Agent.exe, IvantiAgent.exe, or AltirisAgent.exe.

• Scheduled Group Policy Object (GPO) Updates

  • Scenario: A scheduled nightly job runs via the Windows Task Scheduler to refresh Group Policy settings related to Remote Desktop Services. The gpupdate utility triggers a background process that validates and potentially re-registers system DLLs, including termsrv.dll, ensuring compliance with security baselines defined by tools like Microsoft Endpoint Configuration Manager.
  • Filter/Exclusion: Exclude events where the user account is a dedicated service account (e.g., `DOMAIN\GPO-