Chinese Hacktool Set - file Cmdshell32.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the specific “Cmdshell32.exe” tool from a known Chinese hacktool set to establish persistent command-and-control channels or execute reconnaissance scripts within Azure Sentinel environments. Proactively hunting for this file is critical because its low severity classification may cause it to be overlooked in automated alerting, allowing threat actors to maintain a stealthy foothold before escalating their operations.

YARA Rule

rule Cmdshell32 {
	meta:
		description = "Chinese Hacktool Set - file Cmdshell32.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
	strings:
		$s1 = "cmdshell.exe" fullword wide
		$s2 = "cmdshell" fullword ascii
		$s3 = "[Root@CmdShell ~]#" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 62KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Cmdshell32.exe detection rule, tailored for an enterprise environment:

• Antivirus Definition Updates via Local Service

  • Scenario: Enterprise endpoint protection suites (e.g., Trend Micro, Symantec Endpoint Protection, or McAfee) often utilize a local service executable named Cmdshell32.exe to handle background definition updates, policy synchronization, and real-time scanning tasks. This process frequently spawns in the C:\Program Files\Antivirus\ directory but may be misidentified if it is running from a non-standard path or during a scheduled maintenance window.
  • Filter/Exclusion: Create an exclusion for Cmdshell32.exe where the file path contains known vendor directories (e.g., *Trend Micro*, *\Symantec\, *\McAfee*) and the process parent is the specific antivirus service (e.g., tmagent.exe, rudd.exe).

• Third-Party Remote Management & Patching Tools

  • Scenario: IT Operations teams often deploy remote management agents like ManageEngine Desktop Central, Lansweeper, or SolarWinds RMM. These tools may install a helper utility named Cmdshell32.exe to execute shell commands for inventory collection, software deployment, or patch verification. This is common when the tool runs as a scheduled task (e.g., “Daily Inventory Scan”) triggered by the Task Scheduler service (svchost.exe -> taskeng.exe).
  • Filter/Exclusion: Exclude alerts where the process command line includes specific flags associated with these tools (e.g., /scan, /deploy) and the user context is a dedicated system account (e.g., NT AUTHORITY\SYSTEM or a specific `DOMAIN