Chinese Hacktool Set - file Arp EMP v1.0.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific “Arp EMP v1.0.exe” reconnaissance tool to map network topology and identify active hosts within the Azure environment. Proactive hunting is essential because this low-severity file often indicates early-stage footprinting by Chinese threat actors that may precede more aggressive lateral movement or data exfiltration campaigns.

YARA Rule

rule Arp_EMP_v1_0 {
	meta:
		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
	strings:
		$s0 = "Arp EMP v1.0.exe" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 800KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file Arp EMP v1.0.exe detection rule, along with suggested filters and exclusions:

• IT Asset Management Scans via Lansweeper or SCCM

  • Scenario: Enterprise IT teams frequently deploy hardware inventory agents (such as Lansweeper, Microsoft Endpoint Configuration Manager/SCCM, or SolarWinds RMM) that utilize Arp EMP v1.0.exe to perform deep network discovery, ARP table analysis, and endpoint compliance checks on Windows workstations.
  • Suggested Filter: Create an exclusion for the process path located in standard enterprise deployment directories (e.g., C:\Program Files\Lansweeper\Agent\Arp EMP v1.0.exe or C:\Windows\CCM\) and restrict the rule to only trigger if the parent process is not a known service host (svchost.exe) or the specific agent service executable.

• Scheduled Network Diagnostics via PowerShell Scripts

  • Scenario: System administrators often schedule recurring maintenance jobs (e.g., nightly network health checks) using Task Scheduler that invoke Arp EMP v1.0.exe to clear stale ARP cache entries and verify gateway connectivity across subnets before peak business hours.
  • Suggested Filter: Exclude events where the parent process is powershell.exe or cmd.exe running under a specific administrative service account (e.g., DOMAIN\svc-network-maintenance) and occurring during non-business hours (02:00 – 05:00 local time).

• Third-Party Endpoint Security Updates

  • Scenario: Organizations utilizing Chinese-origin endpoint protection suites (such as Tencent PC Manager, 360 Total Security Enterprise, or Kingsoft Antivirus) may