Chinese Hacktool Set - file PcInit.exe

Hunt Hypothesis

This detection identifies the presence of PcInit.exe, a component associated with Chinese-origin hacktools that may indicate reconnaissance or lateral movement activities within the environment. Proactive hunting for this artifact in Azure Sentinel is essential to distinguish legitimate administrative usage from potential adversary footholds, ensuring early identification of low-severity indicators before they evolve into significant threats.

YARA Rule

rule update_PcInit {
	meta:
		description = "Chinese Hacktool Set - file PcInit.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
	strings:
		$s1 = "\\svchost.exe" fullword ascii
		$s2 = "%s%08x.001" fullword ascii
		$s3 = "Global\\ps%08x" fullword ascii
		$s4 = "drivers\\" fullword ascii /* Goodware String - occured 2 times */
		$s5 = "StrStrA" fullword ascii /* Goodware String - occured 43 times */
		$s6 = "StrToIntA" fullword ascii /* Goodware String - occured 44 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 50KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file PcInit.exe detection rule, including suggested filters and exclusions:

Legitimate Deployment of “PC Init” Utility by IT Operations
- Scenario: The internal Desktop Support team deploys a custom utility named PcInit.exe (often part of a broader provisioning suite like SCCM or Intune) to initialize hardware drivers, configure regional settings, and apply group policies on newly imaged Windows 10/11 workstations. This file is often signed by the organization’s internal CA but may lack specific Chinese vendor signatures if the tool was developed in-house or acquired from a non-Chinese provider using generic naming conventions.
- Filter/Exclusion: Create an exclusion for PcInit.exe located specifically within the C:\Program Files\IT_Deployment\Tools\ directory path, provided the file hash matches the known good version deployed by the Change Management team. Additionally, filter on the parent process being ccmexec.exe (SCCM) or Microsoft.Windows.CloudExperienceHost.
Execution via Scheduled Task for Morning System Health Checks
- Scenario: A scheduled task named “Daily_System_Health_Init” runs every day at 06:00 AM to execute PcInit.exe, which performs disk defragmentation, clears temporary cache files, and verifies network connectivity. This script is triggered by the Windows Task Scheduler service (svchost.exe or TaskEng.exe) rather than a user interactive session, mimicking the behavior of automated maintenance tools often flagged as “Hacktool” activity due to its broad system access permissions.
- Filter/Exclusion: Exclude alerts where the parent process is svchost.exe (with command line containing \System32\Tasks) or TaskEng.exe, and the execution time