Chinese Hacktool Set - file lcx.exe

Hunt Hypothesis

This detection rule identifies the execution of lcx.exe, a known component of the Chinese Hacktool set often associated with advanced persistent threat groups targeting intellectual property and infrastructure. Proactively hunting for this artifact in Azure Sentinel is critical to uncover potential early-stage reconnaissance or lateral movement activities that may otherwise remain undetected due to the tool’s low severity classification.

YARA Rule

rule Dos_lcx {
	meta:
		description = "Chinese Hacktool Set - file lcx.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
	strings:
		$s0 = "c:\\Users\\careful_snow\\" ascii
		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
		$s7 = "[-] There is a error...Create a new connection." fullword ascii
		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file lcx.exe detection rule, including suggested filters and exclusions:

• Legitimate Scenario: Deployment of LanTian (LCX) Network Diagnostics Suite by the IT Operations team.

  • Context: The organization uses a proprietary Chinese network monitoring tool named “LanTian” which utilizes lcx.exe as its primary agent for bandwidth analysis and port scanning on Windows endpoints. This is often installed via SCCM or Intune during routine maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion based on the Installation Path (e.g., C:\Program Files\LanTian\Agent\lcx.exe) AND the Parent Process being a known deployment engine like ccmexec.exe or MsDeploy.exe. Additionally, whitelist the specific SHA-256 hash of the vendor-signed binary.

• Legitimate Scenario: Execution of LCX (Local Cache Exchange) Scheduled Backup Job.

  • Context: A scheduled Task in Windows Task Scheduler runs nightly to archive local cache data using a custom internal utility named lcx.exe. This job is triggered by the system account (SYSTEM or NT AUTHORITY\SYSTEM) and runs with high privileges, often generating file creation events that mimic tool activity.
  • Suggested Filter/Exclusion: Exclude alerts where the User Account is NT AUTHORITY\SYSTEM OR DOMAIN\AdminServiceAccount AND the Parent Process is svchost.exe (specifically the TaskScheduler service) or schtasks.exe.

• Legitimate Scenario: Usage of LCX Video Conferencing Client in a hybrid work environment.

  • Context: The enterprise has adopted “LinkConnect” (