ChinaProtectdummy

Hunt Hypothesis

This rule detects the presence of the ChinaProtect dummy file, a known artifact often deployed by APT groups to establish a foothold or facilitate lateral movement within compromised Azure environments. Proactively hunting for this specific file allows the SOC team to identify stealthy persistence mechanisms and potential supply chain compromises that may otherwise go unnoticed by standard behavioral detections.

YARA Rule

rule ChinaProtectdummy
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C3 E8 [4] B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 56 8B [3] 6A 40 68 00 10 00 00 8D [2] 50 6A 00 E8 [4] 89 30 83 C0 04 5E C3 8B 44 [2] 56 8D [2] 68 00 40 00 00 FF 36 56 E8 [4] 68 00 80 00 00 6A 00 56 E8 [4] 5E C3 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via Group Policy

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., a custom inventory management tool) to a fleet of Windows 10/11 endpoints using Group Policy Object (GPO) software installation. The application installer or its associated .dll files are signed with a certificate from a Chinese vendor (e.g., “Beijing XYZ Tech Co., Ltd.”) or contain metadata strings referencing “China” or specific Chinese region codes in the version info, triggering the YARA rule during the initial file write or execution.
  • Filter/Exclusion: Exclude files located in C:\Program Files\ or C:\Program Files (x86)\ that are signed by a trusted internal CA or a known vendor certificate. Alternatively, exclude paths matching \\<server>\sysvol\domain\sysvol\gpo\ during GPO refresh cycles.

• Java/JDK Build Tools in CI/CD Pipeline

  • Scenario: A DevOps pipeline on a Windows build agent executes a Java-based build tool (e.g., Maven or Gradle) that includes a dependency on a library with a Chinese origin (e.g., com.alibaba.fastjson or similar). The YARA rule matches the binary or JAR file due to embedded strings or class names referencing Chinese developers or organizations, especially if the rule is overly broad in matching string patterns like cn. or china in file headers or comments.
  • Filter/Exclusion: Exclude files with extensions .jar, .war, or .class located in standard build directories like C:\builds\, C:\jenkins\workspace\, or C:\temp\. Additionally, exclude processes running under service accounts like jenkins-service or build-agent when the parent process is java.exe