Chinese Hacktool Set - file CmdShell64.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific Chinese hacktool CmdShell64.exe to establish persistent command-and-control channels or execute reconnaissance tasks within the environment. Proactively searching for this artifact in Azure Sentinel is critical because its presence often indicates early-stage lateral movement by threat actors utilizing regional tooling that may evade standard signature-based detections due to its low severity classification.

YARA Rule

rule CmdShell64 {
	meta:
		description = "Chinese Hacktool Set - file CmdShell64.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
	strings:
		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
		$s2 = "ServiceCmdShell" fullword ascii
		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
		$s4 = "ServiceSystemShell" fullword wide
		$s5 = "[Root@CmdShell ~]#" fullword wide
		$s6 = "Hello Man 2015 !" fullword wide
		$s7 = "CmdShell" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 30KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file CmdShell64.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Deployment of Microsoft Endpoint Configuration Manager (MECM/SCCM) Updates

  • Context: During scheduled maintenance windows, SCCM agents often execute remote command shells to push updates or run configuration scripts. The CmdShell64.exe process is frequently spawned by the ccmexec.exe service to handle these tasks on Windows 10/11 endpoints.
  • Filter/Exclusion: Create an exclusion rule that allows CmdShell64.exe when its parent process is ccmexec.exe (Microsoft Endpoint Configuration Manager) and the execution path resides within the standard SCCM installation directory (e.g., C:\Program Files\Microsoft Intune Management Extension\).

• Scenario: Execution of Third-Party Patch Management Tools (e.g., Ivanti or ManageEngine)

  • Context: Enterprise patch management suites often utilize a generic command shell wrapper to execute PowerShell scripts for software installation. If the tool is installed in a custom directory, it may launch CmdShell64.exe as a child of its primary service engine (e.g., IvantiAgent.exe or MEPSService.exe).
  • Filter/Exclusion: Filter out alerts where the parent process name matches known patch management services (IvantiAgent.exe, MEPSService.exe) and the file hash of CmdShell64.exe matches a known, approved baseline hash stored in your asset inventory.

• Scenario: Scheduled Administrative Maintenance Jobs via Windows Task Scheduler

  • Context: System administrators frequently configure recurring tasks to clean temporary files or rotate logs using command-line scripts. These tasks are often triggered by `TaskSchedulerService