Chinese Hacktool Set - file cyclotron.sys

Hunt Hypothesis

This detection identifies the presence of cyclotron.sys, a known component of the Chinese Hacktool set often deployed for system monitoring or data exfiltration in targeted environments. Proactively hunting for this artifact in Azure Sentinel is critical to distinguish legitimate administrative tools from potential adversary persistence mechanisms that may operate with low visibility and minimal initial alerting.

YARA Rule

rule cyclotron {
	meta:
		description = "Chinese Hacktool Set - file cyclotron.sys"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
	strings:
		$s1 = "\\Device\\IDTProt" fullword wide
		$s2 = "IoDeleteSymbolicLink" fullword ascii  /* Goodware String - occured 467 times */
		$s3 = "\\??\\slIDTProt" fullword wide
		$s4 = "IoDeleteDevice" fullword ascii  /* Goodware String - occured 993 times */
		$s5 = "IoCreateSymbolicLink" fullword ascii /* Goodware String - occured 467 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 3KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file cyclotron.sys detection rule, tailored for an enterprise environment:

• Deployment of Chinese Virtualization or Desktop Optimization Suites

  • Scenario: Enterprise IT departments often deploy localized versions of virtualization tools (e.g., VMware Horizon with Chinese language packs, Citrix Workspace, or specific OEM utilities like Lenovo Commercial Cloud) that utilize cyclotron.sys as a core kernel driver for memory management and I/O optimization. The installation or update of these suites triggers the file creation on endpoints.
  • Filter/Exclusion: Exclude the rule trigger if the parent process is a known installer (e.g., msiexec.exe, Setup.exe) running under an administrative account, specifically when the file path resides in standard vendor directories such as C:\Program Files\Lenovo\ or C:\ProgramData\Citrix\.

• Scheduled System Health and Performance Tuning Jobs

  • Scenario: Scheduled maintenance tasks using tools like Microsoft SCCM (Configuration Manager) or third-party patch management solutions (e.g., Ivanti, ManageEngine) may execute a script to refresh system drivers. If the organization uses a Chinese-specific hardware monitoring agent, this job might recreate or update cyclotron.sys during off-hours (e.g., 02:00 AM) without user interaction.
  • Filter/Exclusion: Create an exclusion for events where the parent process is TaskScheduler.exe and the scheduled task name contains keywords like “SystemHealth,” “DriverUpdate,” or “Optimization,” provided the file hash matches a known baseline stored in your asset inventory.

• Installation of Localized Endpoint Security Agents

  • Scenario: In multinational corporations, regional branches may deploy endpoint protection suites with localized components (e