Chinese Hacktool Set - file look.exe

Hunt Hypothesis

This detection identifies the presence of look.exe, a known artifact associated with Chinese hacktool sets that adversaries often deploy for reconnaissance and lateral movement within compromised networks. SOC teams should proactively hunt for this file in Azure Sentinel to validate its legitimacy against baseline inventory, as its low severity classification may mask early-stage foothold activities before more aggressive exploitation occurs.

YARA Rule

rule Dos_look {
	meta:
		description = "Chinese Hacktool Set - file look.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
	strings:
		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
		$s2 = "version=\"9.9.9.9\"" fullword ascii
		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 40KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - look.exe detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Software Updates

  • Context: During scheduled maintenance windows, SCCM agents on Windows servers or workstations may deploy a specific Chinese language pack or a localized diagnostic utility named look.exe as part of a broader update bundle. This is often seen in multinational enterprises with offices in China or supporting Mandarin-speaking users.
  • Filter/Exclusion: Create an exclusion for the process path containing \Microsoft\CCM\ and limit the rule to only trigger if the file hash does not match known Microsoft-signed certificates (e.g., Publisher: Microsoft Corporation).

• Scenario: Third-Party Chinese Productivity Suite Deployment

  • Context: Legitimate deployment of enterprise-grade Chinese productivity tools, such as WPS Office or DingTalk (Aliyun), often includes a background helper process named look.exe used for file indexing or interface rendering. This typically occurs during the initial installation phase or major version upgrades orchestrated by IT admins via Group Policy.
  • Filter/Exclusion: Exclude processes where the parent executable is msiexec.exe, setup.exe, or wpscloud.exe, and restrict the scope to specific user groups (e.g., “IT_Deployment_Team”) or designated application servers.

• Scenario: Automated Compliance Scanning via Scheduled Tasks

  • Context: A scheduled task running under a local system account (e.g., SYSTEM or Network Service) executes a custom compliance script to audit file permissions on shared drives. The script utilizes a legacy internal tool named look.exe located in the C:\Program Files\InternalTools\Audit\ directory, which is frequently triggered by the Windows