Chinese Hacktool Set - file xpf.sys

Hunt Hypothesis

This detection identifies the presence of the xpf.sys driver associated with a known Chinese hacktool set, which adversaries may deploy to establish persistence or evade standard security controls within Azure Sentinel. Proactively hunting for this artifact is critical because its low severity rating often leads to alert fatigue, allowing threat actors to maintain undetected footholds in the environment before escalating their activities.

YARA Rule

rule dat_xpf {
	meta:
		description = "Chinese Hacktool Set - file xpf.sys"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
	strings:
		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
		$s2 = "\\Device\\XScanPF" fullword wide
		$s3 = "\\DosDevices\\XScanPF" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 25KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file xpf.sys detection rule in an enterprise environment:

• Scenario: Deployment of Chinese Language Support Packages via SCCM/Intune

  • Context: System administrators frequently deploy Microsoft Language Packs or third-party localization suites (e.g., Microsoft Office Chinese Simplified Language Pack) to endpoints. During the installation phase, these packages extract and register xpf.sys as a kernel-mode driver for input method editors (IME) or font rendering.
  • Filter/Exclusion: Create an exclusion based on the parent process name (msiexec.exe, ccmsetup.exe, or intune-management-agent.exe) combined with the file path located within standard installation directories (e.g., C:\Program Files\Microsoft Office\Root\VFS\... or C:\Windows\System32\en-US).

• Scenario: Execution of Antivirus Real-Time Scanning by Enterprise Security Suites

  • Context: Major enterprise EDR solutions, such as CrowdStrike Falcon, Symantec Endpoint Protection, or Trend Micro Deep Security, often utilize xpf.sys (or similarly named drivers) for their deep inspection modules. When the security agent performs a scheduled scan or updates its signature database, it loads this driver, triggering the detection logic even though the file is benign and signed by the vendor.
  • Filter/Exclusion: Exclude events where the xpf.sys file path resides within the specific EDR installation folder (e.g., C:\Program Files\CrowdStrike\...) AND the file signature status indicates a valid certificate from the respective security vendor (CrowdStrike, Symantec, etc.).

• Scenario: Scheduled Maintenance Jobs for Virtualization or Backup Agents

  • Context: In environments running **VM