Chinese Hacktool Set - file cndcom.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the cndcom.exe component of a Chinese Hacktool set to establish persistent command-and-control or reconnaissance capabilities within the environment. Proactively hunting for this specific artifact in Azure Sentinel is critical because its low-severity classification may cause it to be overlooked by automated alerts, allowing stealthy initial footholds to mature into significant threats before detection.

YARA Rule

rule cndcom_cndcom {
	meta:
		description = "Chinese Hacktool Set - file cndcom.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "08bbe6312342b28b43201125bd8c518531de8082"
	strings:
		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
		$s7 = "\\C$\\123456111111111111111.doc" fullword wide
		$s8 = "shell3all.c" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file cndcom.exe detection rule, tailored for an enterprise environment:

• Scenario: Deployment of Chinese Language Support Tools via SCCM/Intune

  • Context: IT administrators frequently deploy localized versions of Microsoft Office or Windows updates to support Mandarin-speaking staff. The installer package often includes cndcom.exe as a legitimate component for language configuration and network diagnostics, which is mistakenly flagged as the malicious Chinese Hacktool.
  • Filter/Exclusion: Create an exclusion based on the File Hash of the known good version deployed by your organization. Additionally, exclude execution paths under standard enterprise deployment folders (e.g., C:\Program Files\Microsoft Office\ or C:\Windows\CCMCache\) where the parent process is ccmexec.exe (System Center Configuration Manager) or IntuneManagementExtension.exe.

• Scenario: Scheduled Maintenance by Third-Party Chinese ERP Software

  • Context: Enterprises utilizing Chinese Enterprise Resource Planning (ERP) solutions, such as Kingdee K/3 or Yonyou U8, often run background synchronization services. These applications utilize cndcom.exe to manage database connections and license validation during off-hours scheduled tasks.
  • Filter/Exclusion: Implement a rule exception for the specific Parent Process Name associated with these ERP suites (e.g., KingdeeService.exe or YonyouAgent.exe). Furthermore, restrict the alert to only trigger if the file path is located outside of the application’s designated installation directory (e.g., exclude files in C:\Program Files\Kingsoft\ or D:\ERP_Apps\).

• Scenario: Execution by Chinese Antivirus Endpoint Protection

  • Context: Many organizations deploy specialized endpoint protection suites