Chinese Hacktool Set - file xsniff.exe

Hunt Hypothesis

This hunt targets adversaries deploying the xsniff.exe network packet capture tool to exfiltrate sensitive traffic data or establish persistent command-and-control channels within Azure Sentinel workloads. Proactive hunting is essential because this specific artifact often indicates early-stage reconnaissance by threat actors utilizing Chinese-origin tooling, allowing the SOC team to identify and isolate potential lateral movement before it escalates into a high-severity incident.

YARA Rule

rule CN_Tools_xsniff {
	meta:
		description = "Chinese Hacktool Set - file xsniff.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
	strings:
		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file xsniff.exe detection rule, including suggested filters or exclusions:

• Scenario: Deployment of Network Monitoring Agents by IT Operations

  • Context: The enterprise deploys a network traffic analysis agent (e.g., SolarWinds NPM, PRTG Network Monitor, or ManageEngine OpManager) which installs xsniff.exe as its core packet capture service. This file is often located in C:\Program Files\NetworkMonitoring\Agent\.
  • Suggested Filter: Create an exclusion based on the file path and parent process name. Exclude xsniff.exe if it resides within a known vendor directory (e.g., *\SolarWinds*, *\ManageEngine*) OR if the parent process is the specific installer service (e.g., msiexec.exe or setup.exe).

• Scenario: Scheduled Log Analysis Job by Security Operations

  • Context: A scheduled task runs nightly to parse raw packet captures for compliance reporting. The job utilizes a custom wrapper script that launches xsniff.exe (part of the Wireshark/TShark distribution or a proprietary Cisco Stealthwatch component) from the C:\Tools\NetworkAnalysis\ directory.
  • Suggested Filter: Exclude alerts where the parent process is svchost.exe running under the “Task Scheduler” service account (NT AUTHORITY\SYSTEM) and the file hash matches a known benign version of the tool used in this specific workflow.

• Scenario: Third-Party Application Performance Monitoring (APM) Installation

  • Context: During a quarterly update, the APM team installs Dynatrace OneAgent or AppDynamics, which includes xsniff.exe as a