Chinese Hacktool Set - file arpsniffer.exe

Hunt Hypothesis

This hunt targets adversaries deploying the arpsniffer.exe tool from the Chinese Hacktool set to conduct network reconnaissance and intercept traffic via ARP spoofing within Azure Sentinel. Proactively hunting for this specific artifact is critical because its low severity classification often leads to alert fatigue, allowing stealthy initial footholds by threat actors to go unnoticed before escalating into more significant data exfiltration or lateral movement campaigns.

YARA Rule

rule arpsniffer {
	meta:
		description = "Chinese Hacktool Set - file arpsniffer.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
	strings:
		$s1 = "SHELL" ascii
		$s2 = "PacketSendPacket" fullword ascii
		$s3 = "ArpSniff" ascii
		$s4 = "pcap_loop" fullword ascii  /* Goodware String - occured 3 times */
		$s5 = "packet.dll" fullword ascii  /* Goodware String - occured 4 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 120KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file arpsniffer.exe detection rule, including suggested filters and exclusions:

• Network Baseline Audits via SolarWinds NPM or PRTG

  • Scenario: Network administrators frequently deploy SolarWinds Network Performance Monitor (NPM) or Paessler PRTG agents to perform deep packet inspection and ARP table analysis. These tools often utilize a bundled executable named arpsniffer.exe within their installation directory (C:\Program Files\SolarWinds\Agent\) to capture real-time MAC-to-IP mappings for troubleshooting VLAN conflicts.
  • Filter/Exclusion: Create an exclusion rule based on the file path hash or parent process name. Exclude any arpsniffer.exe instances where the Parent Process is SolarWinds.Agent.Service.exe or PRTGNetworkMonitorService.exe, and the file resides within the standard C:\Program Files\ directory structure.

• Scheduled IT Asset Discovery Jobs (Lansweeper)

  • Scenario: During nightly maintenance windows, IT asset management platforms like Lansweeper execute scheduled discovery tasks to update hardware inventories. The agent launches a custom utility named arpsniffer.exe to scan the local subnet for connected devices and verify ARP cache consistency before generating inventory reports. This is often triggered by Windows Task Scheduler under the account SYSTEM.
  • Filter/Exclusion: Implement a logic filter that excludes events where the User Account is NT AUTHORITY\SYSTEM or a dedicated service account (e.g., svc_lansweeper) and the Start Time falls within the defined maintenance window (e.g., 02:00–04:00 local time). Additionally, verify the file path matches the Lansweeper agent directory.