Chinese Hacktool Set - file NaslLib.dll

Hunt Hypothesis

This hunt targets adversaries deploying the NaslLib.dll component associated with Chinese hacktools to establish persistent network monitoring capabilities within Azure Sentinel. Proactively searching for this file is critical because its presence often indicates early-stage reconnaissance or lateral movement by threat actors utilizing specialized tooling that may evade standard signature-based defenses.

YARA Rule

rule dat_NaslLib {
	meta:
		description = "Chinese Hacktool Set - file NaslLib.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
	strings:
		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1360KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file NaslLib.dll detection rule, tailored for an enterprise environment:

• Antivirus or EDR Real-Time Scanning of Legacy Applications

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection) performs a real-time scan on a legacy Chinese business application (such as a localized ERP module or a proprietary HR portal). During the scan, the AV engine extracts or loads NaslLib.dll from the application’s installation directory (C:\Program Files\ChineseApp\Bin) to verify its integrity against known malware signatures.
  • Filter/Exclusion: Create an exclusion for the specific file path (e.g., C:\Program Files\ChineseApp\Bin\NaslLib.dll) and exclude the AV scanner process (e.g., csagent.exe, s1service.exe) from triggering this rule when accessing files within that directory.

• Scheduled Software Deployment via SCCM or Intune

  • Scenario: A scheduled maintenance job runs during off-hours to deploy a patch for a Chinese collaboration tool (like DingTalk Enterprise or WeChat Work). The deployment engine (Microsoft Endpoint Configuration Manager or Microsoft Intune) extracts the update package, which includes NaslLib.dll, into a temporary staging folder (C:\Windows\CCMCache) before installation.
  • Filter/Exclusion: Exclude file creation events where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe and the destination path matches the known deployment cache directories.

• Development Environment Build Processes

  • Scenario: In a software development department, automated build pipelines (using Jenkins or Azure DevOps Agents) compile a .NET-based internal tool that integrates Chinese language support libraries.