← Back to SOC feed Coverage →

Chinese Hacktool Set - file Shiell.exe

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-16T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the presence of the “Shiell.exe” executable associated with a known Chinese hacktool set, which may indicate reconnaissance or persistence activities by threat actors targeting regional infrastructure. Proactively hunting for this artifact in Azure Sentinel is critical to validate its legitimacy and distinguish benign tooling from potential supply chain compromises before they escalate into broader incidents.

YARA Rule

rule CN_Tools_Shiell {
	meta:
		description = "Chinese Hacktool Set - file Shiell.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
	strings:
		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
		$s3 = "Shift shell.exe" fullword wide
		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1500KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Shiell.exe detection rule, tailored for an enterprise environment:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_Chinese_Hacktools.yar