Chinese Hacktool Set - file PcShare.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the legitimate utility PcShare.exe to establish a foothold within Windows environments for lateral movement and data exfiltration under the guise of routine operations. Proactively hunting for this specific artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked by automated alerts, allowing threat actors to maintain persistent access while evading standard detection thresholds.

YARA Rule

rule CN_Tools_PcShare {
	meta:
		description = "Chinese Hacktool Set - file PcShare.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
	strings:
		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
		$s16 = "%s\\ini\\*.dat" fullword wide
		$s17 = "pcinit.exe" fullword wide
		$s18 = "http://www.pcshare.cn" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 6000KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file PcShare.exe detection rule in an enterprise environment:

• Deployment of Chinese Collaboration Suites by IT Operations

  • Scenario: The IT department deploys or updates “PcShare” (a remote desktop and screen sharing utility often used by Chinese enterprises for internal support) via the SCCM/MECM agent. This triggers the rule when PcShare.exe is written to the C:\Program Files\PcShare\ directory during a scheduled maintenance window.
  • Filter/Exclusion: Exclude file creation and modification events where the parent process is ccmexec.exe (System Center Configuration Manager) or TaskScheduler.exe, specifically targeting the path C:\Program Files\PcShare\*.

• Automated Patching via Third-Party RMM Tools

  • Scenario: A Remote Monitoring and Management (RMM) tool, such as ManageEngine Desktop Central or Lansweeper, automatically pushes a security patch to PcShare.exe on endpoints running in the APAC region. The detection fires when the installer extracts the executable during the background update cycle.
  • Filter/Exclusion: Create an exclusion for events where the parent process is DCAgentService.exe (ManageEngine) or LSAgent.exe, and the user context is a local service account (e.g., NT AUTHORITY\SYSTEM) rather than an interactive user session.

• Scheduled Backup of Shared Configuration Files

  • Scenario: A nightly scheduled task runs to back up configuration files for the PcShare client to a network share or cloud storage. The backup software, such as Veeam Agent or Acronis Cyber Protect, reads and potentially creates temporary copies of PcShare.exe to verify integrity before arch