Chinese Hacktool Set - file 1.exe

Hunt Hypothesis

This detection identifies the execution of a generic “1.exe” process associated with the Chinese Hacktool set, which adversaries often use to establish persistence or conduct reconnaissance while blending in as legitimate system activity. Proactively hunting for this behavior in Azure Sentinel is critical because its low severity and common naming convention allow it to evade standard alerting thresholds, potentially masking early-stage lateral movement or data exfiltration attempts by threat actors targeting Chinese infrastructure.

YARA Rule

rule Dos_1 {
	meta:
		description = "Chinese Hacktool Set - file 1.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
	strings:
		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are specific false positive scenarios for the Chinese Hacktool Set - file 1.exe detection rule, including suggested filters and exclusions:

Legacy Internal Deployment Scripts: Many enterprises utilize legacy deployment scripts or installer wrappers (e.g., custom PowerShell scripts invoking a generic setup.exe which extracts to C:\Temp\1.exe) for patching internal applications. These scripts often use “1.exe” as a default filename for temporary extraction before renaming.
- Suggested Filter: Exclude processes where the parent process is a known deployment tool (e.g., SCCM, Ansible, or PowerShell.exe) and the file path contains \Temp\ or \Staging\.
Scheduled Maintenance Jobs via Task Scheduler: Automated maintenance tasks, such as database backup utilities or log rotation tools, often run under a generic service account. If these jobs extract a temporary utility named 1.exe to perform a quick check before execution (common in Chinese-developed enterprise management suites like Kingdee or Yonyou), they will trigger this rule.
- Suggested Filter: Create an exclusion for the specific hash of 1.exe located in standard application directories (e.g., C:\Program Files\Kingsoft\Tools\) and restrict the alert to only fire if the process is running outside of defined business hours or from a non-standard directory.
Third-Party Endpoint Security Scanners: Antivirus or EDR agents frequently download temporary scanning modules or definition update utilities named 1.exe during their scheduled scan cycles. For instance, tools like Symantec Endpoint Protection or Trend Micro often instantiate generic executables for on-demand scans that match this signature.
- Suggested Filter: Add an exclusion based on the parent process name (e.g., Symantec Antivirus, TrendMicro Agent) and ensure the file path matches the vendor’s installation