Chinese Hacktool Set - file WSockExpert.exe

Hunt Hypothesis

This hunt targets adversaries deploying the WSockExpert.exe tool to establish persistent network reconnaissance capabilities within Azure Sentinel environments. Proactively hunting for this specific artifact is critical because its presence often indicates early-stage espionage activities that may precede more aggressive data exfiltration or lateral movement attempts.

YARA Rule

rule WSockExpert {
	meta:
		description = "Chinese Hacktool Set - file WSockExpert.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
	strings:
		$s1 = "OpenProcessCmdExecute!" fullword ascii
		$s2 = "http://www.hackp.com" fullword ascii
		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
		$s5 = "PasswordChar@" fullword ascii
		$s6 = "WSockHook.DLL" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2500KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file WSockExpert.exe detection rule, including suggested filters and exclusions:

• Legacy Remote Support Sessions via WSockExpert

  • Scenario: The organization utilizes WSockExpert (a Chinese remote desktop/terminal tool) as a primary support channel for legacy Windows 7 workstations or specific manufacturing floor terminals where standard RDP is restricted. Legitimate IT Helpdesk analysts frequently launch WSockExpert.exe from the %ProgramFiles%\WSockExpert\ directory to troubleshoot user issues, triggering the rule due to the file’s inherent association with Chinese tooling sets.
  • Filter/Exclusion: Create an exclusion for process execution where the Parent Process is a known administrative launcher (e.g., conhost.exe, explorer.exe) and the File Path matches exactly: C:\Program Files\WSockExpert\WSockExpert.exe. Additionally, exclude events originating from specific User Accounts within the “IT-Support” security group.

• Automated Patch Deployment via SCCM/MECM Task Sequence

  • Scenario: During scheduled maintenance windows (e.g., Sundays at 02:00 AM), the enterprise uses Microsoft Endpoint Configuration Manager (SCCM) to deploy a custom update package that includes WSockExpert as a dependency for remote monitoring agents. The deployment task sequence executes WSockExpert.exe as part of a silent installation or configuration script (msiexec.exe or powershell.exe parent), which is flagged as suspicious due to the file’s origin.
  • Filter/Exclusion: Exclude events where the Parent Process Name is ccmexec.exe (SCCM) or wsmprovhost.exe, and the Process Command Line contains flags indicating a silent installation (e.g