Chinese Hacktool Set - file unknown.exe

Hunt Hypothesis

This detection identifies the execution of a generic “unknown.exe” process associated with known Chinese hacktools, which often serve as initial footholds for reconnaissance or lateral movement by state-sponsored actors. Proactively hunting for this behavior in Azure Sentinel is critical because low-severity alerts involving generic filenames frequently evade standard threshold-based detections, allowing adversaries to persist undetected while establishing command-and-control channels.

YARA Rule

rule Tools_unknown {
	meta:
		description = "Chinese Hacktool Set - file unknown.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
	strings:
		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii /* PEStudio Blacklist: agent */
		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
		$s5 = "Host: 127.0.0.1" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file unknown.exe detection rule, tailored for a legitimate enterprise environment:

• Endpoint Detection and Response (EDR) Self-Update Agents

  • Scenario: Major EDR platforms often drop temporary executable files named generically during their update cycles. For instance, CrowdStrike Falcon, SentinelOne, or Trend Micro may extract a payload to %TEMP% or %ProgramData% named unknown.exe (or similar) before renaming it upon successful installation verification.
  • Filter/Exclusion: Exclude file paths containing the vendor’s specific installation directory (e.g., \CrowdStrike\, \SentinelOne\) and exclude files with a digital signature from trusted vendors like “Trend Micro Inc.” or “SentinelOne, Inc.”

• Scheduled Patch Management Deployments

  • Scenario: Enterprise patch management tools such as Microsoft SCCM (Configuration Manager), Ivanti, or ManageEngine Endpoint Central frequently stage deployment packages. During the execution of a scheduled job (e.g., “Monthly Security Patch”), these agents may extract a temporary installer named unknown.exe to the local system drive (C:\Windows\CCMCache) before launching the actual update engine.
  • Filter/Exclusion: Create an exclusion for files located in standard cache directories (e.g., \CCMCache\, \Ivanti\Cache\) and filter by process parent names like ccmexec.exe or IvAntiAgent.exe.

• Remote Desktop Protocol (RDP) Session Initialization

  • Scenario: When IT administrators connect via RDP to perform maintenance, the session host often spins up temporary helper processes. Tools like Microsoft Remote Desktop Services or third-party remote access solutions (e.g