Chinese Hacktool Set - file xscan_gui.exe

Hunt Hypothesis

This hunt targets adversaries deploying the xscan_gui.exe reconnaissance tool to map network topology and identify potential vulnerabilities within Azure workloads. Proactively hunting for this artifact is critical because its presence often signals early-stage information gathering by threat actors associated with Chinese hacktool sets, allowing the SOC to detect lateral movement before exploitation occurs.

YARA Rule

rule xscan_gui {
	meta:
		description = "Chinese Hacktool Set - file xscan_gui.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
	strings:
		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
		$s2 = "www.target.com" fullword ascii
		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file xscan_gui.exe detection rule, including suggested filters and exclusions:

Scenario: Deployment of X-Scan Network Assessment Suite by IT Operations
- Context: The internal Network Security team utilizes the legitimate “X-Scan” enterprise version (often distributed as a standalone installer) to perform scheduled vulnerability assessments on the corporate LAN. During these scans, xscan_gui.exe is launched from the standard installation directory (C:\Program Files\X-Scan Enterprise\) to generate reports.
- Suggested Filter/Exclusion: Create an exclusion for files located in C:\Program Files\X-Scan Enterprise\* where the file hash matches the known good signature of the official X-Scan installer (e.g., SHA256: a1b2c3...). Additionally, exclude processes spawned by the “System” or specific Service Accounts used for network scanning.
Scenario: Execution via Scheduled Task for Compliance Reporting
- Context: A compliance audit requires a nightly scan of endpoint configurations. An administrator has created a Windows Scheduled Task named Daily_Compliance_Scan that triggers at 02:00 AM, launching xscan_gui.exe with command-line arguments to run in headless mode and output results to a shared network drive (\\FileServer\Reports).
- Suggested Filter/Exclusion: Exclude the specific process path C:\Windows\System32\Tasks\Daily_Compliance_Scan or filter based on the parent process being TaskScheduler.exe. Ensure the command line arguments contain specific flags (e.g., -mode=report -output=\\FileServer) to distinguish it from interactive user launches.
Scenario: Installation and Configuration by Endpoint Management Tool
- Context: The