Chinese Hacktool Set - file srss.exe

Hunt Hypothesis

This detection identifies the presence of srss.exe, a known component within the Chinese Hacktool set often associated with advanced persistent threat reconnaissance and system enumeration activities. Proactively hunting for this artifact in Azure Sentinel is critical to uncover early-stage adversary footholds that may remain dormant before escalating into more complex lateral movement or data exfiltration campaigns.

YARA Rule

rule CN_Tools_srss_2 {
	meta:
		description = "Chinese Hacktool Set - file srss.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
	strings:
		$x1 = "used pepack!" fullword ascii

		$s1 = "KERNEL32.dll" fullword ascii
		$s2 = "KERNEL32.DLL" fullword ascii
		$s3 = "LoadLibraryA" fullword ascii
		$s4 = "GetProcAddress" fullword ascii
		$s5 = "VirtualProtect" fullword ascii
		$s6 = "VirtualAlloc" fullword ascii
		$s7 = "VirtualFree" fullword ascii
		$s8 = "ExitProcess" fullword ascii
	condition:
		uint16(0) == 0x5a4d and ( $x1 at 0 ) and filesize < 14KB and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - srss.exe detection rule, tailored for a legitimate enterprise environment:

• Scenario: Microsoft System Center Configuration Manager (SCCM) Software Updates

  • Context: During scheduled maintenance windows, SCCM agents on Windows 10/11 endpoints execute software updates or patch deployments. The srss.exe process is often invoked by the SCCM client service (ccmexec.exe) to handle secure communication and remote session services during these installations.
  • Filter/Exclusion: Create an exclusion for srss.exe when it is launched as a child of ccmexec.exe. Additionally, exclude instances where the file path resides strictly within C:\Windows\CCM\ or C:\Program Files (x86)\Microsoft Intune Management Extension\.

• Scenario: Citrix Virtual Apps and Desktops Session Broker

  • Context: In environments running Citrix XenApp or VDI, the srss.exe process is a core component of the Citrix Secure Remote Services. It runs persistently on endpoint machines to manage secure connections between the user’s local machine and the virtual desktop session, often triggering file creation events during session initialization.
  • Filter/Exclusion: Exclude srss.exe execution when the parent process is wfcrun32.exe (Citrix Workspace) or wfcmd.exe. Furthermore, filter by file path matching C:\Program Files\Citrix\ICA Client\ to ensure only legitimate Citrix binaries are whitelisted.

• Scenario: Automated Group Policy Preferences (GPP) Deployment

  • Context: IT administrators frequently use Group Policy Objects to deploy scripts or configure remote desktop settings across the domain. When a GPO containing “Remote Desktop Services” configurations is applied