Chinese Hacktool Set - file DTools.exe

Hunt Hypothesis

This detection identifies the presence of DTools.exe, a component of the Chinese Hacktool suite often associated with reconnaissance and lateral movement activities by advanced persistent threat actors targeting government or critical infrastructure sectors. Proactively hunting for this artifact in Azure Sentinel is essential to validate its legitimacy against baseline inventory, as its low severity classification may cause it to be overlooked during routine alert triage despite its potential role in early-stage intrusion campaigns.

YARA Rule

rule DTools2_02_DTools {
	meta:
		description = "Chinese Hacktool Set - file DTools.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
	strings:
		$s0 = "kernel32.dll" ascii
		$s1 = "TSETPASSWORDFORM" fullword wide
		$s2 = "TGETNTUSERNAMEFORM" fullword wide
		$s3 = "TPORTFORM" fullword wide
		$s4 = "ShellFold" fullword ascii
		$s5 = "DefaultPHotLigh" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file DTools.exe detection rule, along with recommended filters and exclusions:

• Scenario: Deployment of Chinese Language Support or Localization Tools

  • Context: In multinational enterprises, IT teams often deploy localization suites (e.g., Microsoft Language Interface Pack, AntsWord, or third-party translation utilities like Trados Studio) that utilize DTools.exe as a background service to manage dictionary updates and UI rendering for Chinese-speaking users.
  • Filter/Exclusion: Create an exclusion based on the File Hash (SHA-256) of the legitimate vendor’s version of DTools.exe. Additionally, filter alerts where the parent process is a known deployment agent like Microsoft Endpoint Configuration Manager (SMS_EXECUTIVE) or SCCM Client Agent.

• Scenario: Scheduled Maintenance for Chinese ERP Modules

  • Context: Organizations running Chinese Enterprise Resource Planning systems (such as Kingdee K/3, Yonyou U8, or localized versions of SAP) often run scheduled batch jobs to synchronize data between local and global databases. These jobs frequently invoke DTools.exe to perform data validation, character set conversion, or log compression during off-hours.
  • Filter/Exclusion: Exclude alerts triggered by the Task Scheduler Service (svchost.exe) where the task name contains keywords like “KingdeeSync,” “YonyouBackup,” or “ChineseDataJob.” Alternatively, restrict the rule to only trigger if DTools.exe is launched from a non-standard directory (e.g., outside of C:\Program Files\Kingdee or C:\Program Files\Yonyou).

• Scenario: Execution by Chinese Remote Desktop or VDI Optimization Suites

  • Context: Virtual Desktop