Chinese Hacktool Set - file PcMain.dll

Hunt Hypothesis

This detection targets the presence of the PcMain.dll artifact associated with the Chinese Hacktool set, indicating potential reconnaissance or lateral movement activities by threat actors utilizing this specific tool suite. Proactively hunting for this file in Azure Sentinel is critical to identify early-stage adversary footprints that may precede more significant data exfiltration or persistence mechanisms within the environment.

YARA Rule

rule update_PcMain {
	meta:
		description = "Chinese Hacktool Set - file PcMain.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
		$s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
		$s3 = "\\svchost.exe -k " fullword ascii
		$s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
		$s9 = "Global\\%s-key-event" fullword ascii
		$s10 = "%d%d.exe" fullword ascii
		$s14 = "%d.exe" fullword ascii
		$s15 = "Global\\%s-key-metux" fullword ascii
		$s18 = "GET / HTTP/1.1" fullword ascii
		$s19 = "\\Services\\" fullword ascii
		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file PcMain.dll detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legitimate Deployment of “PcMain” Utility by IT Operations

  • Scenario: The internal IT team deploys a proprietary patch management utility named PcMain.exe (which loads the dynamic library PcMain.dll) to manage driver updates across Windows 10/11 endpoints. This activity is triggered during standard business hours via Group Policy or SCCM, often generating file creation events that mimic the behavior of Chinese remote administration tools.
  • Suggested Filter: Exclude file paths located within the enterprise software distribution directories (e.g., C:\Program Files\CompanyIT\PatchManager\ or C:\Windows\CCMCache\) and restrict alerts to non-standard execution paths like C:\Users\Public\Temp\.

• Scheduled Maintenance by Third-Party Hardware Diagnostics Tool

  • Scenario: A scheduled nightly job runs a third-party hardware diagnostic suite (e.g., “SystemHealth Pro” or a vendor-specific utility from Dell/HP) that utilizes a component named PcMain.dll to scan BIOS and peripheral health. The rule triggers because the tool executes with elevated privileges during the maintenance window, creating or updating the DLL file in the local application data folder.
  • Suggested Filter: Create an exclusion for processes running under specific scheduled task names (e.g., TaskName: "NightlyHardwareScan") and filter out events where the parent process is a known trusted vendor executable (e.g., SystemHealthPro.exe or DellUpdateAgent.exe).

• Development Environment Build Artifacts

  • Scenario: Software developers on internal workstations run local build scripts using Visual Studio or MSBuild.