Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library

Hunt Hypothesis

This hunt targets adversaries deploying the PacketX.dll ActiveX wrapper to establish persistent network visibility and traffic analysis capabilities within Windows environments. Proactively hunting for this artifact in Azure Sentinel is critical because its presence often indicates early-stage reconnaissance by Chinese threat actors who leverage custom packet capture libraries to evade standard detection mechanisms.

YARA Rule

rule dll_PacketX {
	meta:
		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		score = 50
		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
	strings:
		$s9 = "[Failed to load winpcap packet.dll." wide
		$s10 = "PacketX Version" wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1920KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file PacketX.dll detection rule, tailored for an enterprise environment:

• Network Monitoring and Traffic Analysis Tools

  • Scenario: Deployment of legitimate network visibility solutions such as SolarWinds Network Performance Monitor (NPM), PRTG Network Monitor, or Wireshark running on server endpoints. These tools often utilize the PacketX.dll ActiveX wrapper to interface with WinPcap for real-time packet sniffing and traffic analysis, triggering the rule during routine health checks or bandwidth profiling.
  • Suggested Filter: Exclude the specific process names associated with these monitoring agents (e.g., SolarWinds.Agent.exe, PRTGProbe.exe, Wireshark.exe) from generating alerts when accessing PacketX.dll.

• Endpoint Detection and Response (EDR) Packet Capture Modules

  • Scenario: Execution of deep packet inspection features within EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne. When an administrator initiates a “Network Snapshot” or “Packet Capture” diagnostic job to investigate a potential lateral movement, the EDR’s native capture engine loads PacketX.dll as part of its ActiveX integration layer.
  • Suggested Filter: Create an exclusion for the primary EDR service executables (e.g., C:\Program Files\CrowdStrike\fs.exe, MsMpEng.exe) and their scheduled diagnostic tasks that explicitly invoke packet capture libraries.

• Scheduled Database Performance Audits

  • Scenario: Automated nightly jobs running on SQL Server or Oracle database servers using tools like SQL Server Profiler or Oracle Enterprise Manager. These tools often leverage PacketX.dll to capture and analyze network latency between the database engine and application tiers during peak maintenance windows