Chinese Hacktool Set - file NC.EXE

Hunt Hypothesis

This detection identifies the presence of the NC.EXE executable, a known component of the Chinese Hacktool set often associated with reconnaissance and lateral movement activities by state-sponsored threat actors. Proactively hunting for this file in Azure Sentinel is critical to uncover early-stage adversary footholds that may evade standard signature-based alerts due to their low severity classification and legitimate appearance.

YARA Rule

rule Dos_NC {
	meta:
		description = "Chinese Hacktool Set - file NC.EXE"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "57f0839433234285cc9df96198a6ca58248a4707"
	strings:
		$s1 = "nc -l -p port [options] [hostname] [port]" fullword ascii
		$s2 = "invalid connection to [%s] from %s [%s] %d" fullword ascii
		$s3 = "post-rcv getsockname failed" fullword ascii
		$s4 = "Failed to execute shell, error = %s" fullword ascii
		$s5 = "UDP listen needs -p arg" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 290KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file NC.EXE detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Network Configuration Utility Deployment

  • Context: The NC.EXE filename is frequently used by legitimate network management suites (e.g., Huawei eSight, H3C iMC, or custom internal tools named “Network Controller”) deployed on Windows servers to manage switch configurations. When these utilities are installed or updated via a standard installer, the file is created in C:\Program Files\VendorName\NC.EXE.
  • Filter/Exclusion: Exclude paths matching known vendor directories and restrict the rule to specific parent processes (e.g., msiexec.exe or setup.exe).
    • Path Filter: C:\Program Files\Huawei\*, C:\Program Files\H3C\*, C:\Program Files\InternalIT\NetworkController\NC.EXE.
    • Parent Process Filter: Exclude if Parent Image Name is msiexec.exe or Microsoft.Workflow.Compiler.exe.

• Scenario: Scheduled Patch Management and Compliance Scans

  • Context: Enterprise patch management tools like Ivanti, ManageEngine Endpoint Central, or SCCM (System Center Configuration Manager) often utilize a lightweight agent component named NC.EXE to perform nightly compliance checks, network connectivity tests, or software inventory scans. These run as scheduled tasks under the context of the Local System account.
  • Filter/Exclusion: Create an exclusion based on the specific Scheduled Task name and the user context.
    • Task Filter: Exclude events where Scheduled Task Name contains “PatchCompliance”, “InventoryScan”, or “NetworkHealthCheck”.
    • User Context: