Chinese Hacktool Set - file Vscan.exe

Hunt Hypothesis

This detection identifies the presence of Vscan.exe, a component associated with Chinese hacktool suites that may indicate reconnaissance or lateral movement activities within the environment. Proactively hunting for this artifact in Azure Sentinel is critical to validate its legitimacy and distinguish between authorized security tools and potential supply chain compromises originating from regions with distinct threat actor profiles.

YARA Rule

rule CN_Tools_Vscan {
	meta:
		description = "Chinese Hacktool Set - file Vscan.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
	strings:
		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 60KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Vscan.exe detection rule, tailored for an enterprise environment:

Scenario: Deployment of Avast Endpoint Security or Antivirus Scans
- Context: The Vscan.exe binary is a core component of the Avast/AVG antivirus suite (often used in mixed environments alongside Chinese security stacks). It frequently triggers when the endpoint performs scheduled full-system scans, real-time file protection scans on high-traffic directories (e.g., /mnt/data or C:\Users\Public), or during the initial installation phase of a new patch.
- Suggested Filter/Exclusion: Exclude the process path C:\Program Files\Avast Software\Avast\vscan.exe and C:\ProgramData\AVAST Software\Avast\vscan.exe. Additionally, filter out events where the parent process is avcenter.exe or avgidsagent.exe to ensure only legitimate Avast-initiated scans are ignored.
Scenario: Execution of Third-Party Chinese Security Suites (e.g., Tencent PC Manager or 360 Total Security)
- Context: In enterprises with a presence in Asia or specific vendor requirements, tools like Tencent PC Manager or Qihoo 360 Total Security utilize Vscan.exe as their primary scanning engine. This triggers during routine “Health Checks,” disk cleanup operations, or when the software automatically updates its virus definition database at 2:00 AM daily via a scheduled task.
- Suggested Filter/Exclusion: Create an exclusion based on the specific SHA-256 hash of the legitimate Vscan.exe binary provided by these vendors (e.g., a1b2c3...). Alternatively, exclude events where the command line arguments contain flags like /scheduled,