This hunt targets adversaries deploying the DUBrute.exe tool from the Chinese Hacktool set to conduct brute-force credential attacks or reconnaissance within the Azure environment. Proactively hunting for this specific artifact allows the SOC team to identify early-stage lateral movement and potential supply chain compromises before they escalate into critical security incidents.
rule DUBrute_DUBrute {
meta:
description = "Chinese Hacktool Set - file DUBrute.exe"
author = "Florian Roth"
reference = "http://tools.zjqhr.com/"
date = "2015-06-13"
hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
strings:
$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
$s3 = "Create %d IP@Loginl;Password" fullword ascii
$s4 = "UBrute.com" fullword ascii
condition:
uint16(0) == 0x5a4d and filesize < 1020KB and all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 4 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file DUBrute.exe detection rule, including suggested filters and exclusions:
Scenario: Deployment of Alibaba Cloud Security Agent (Cloud Security Center)
DUBrute.exe process is a core component of the Alibaba Cloud Security Agent (often part of the “Alibaba Cloud Security Center” or “SAS”). In enterprise environments, this agent is frequently deployed via Group Policy or Configuration Management tools to monitor cloud workloads and on-premises servers.DUBrute.exe when running under the service account AlibabaCloudSecurityService (or specifically the process path C:\Program Files\Alibaba Cloud Security Agent\). Additionally, exclude events where the parent process is TencentCloudAgent.exe or AliyunService.exe.Scenario: Execution of Scheduled Patch Management Jobs
DUBrute.exe to perform a brute-force credential check or vulnerability assessment on endpoints during off-hours (e.g., 02:00 AM).TaskSchedulerService (svchost.exe) and the command line arguments contain specific flags like /scheduled, -scan, or references to a known job ID. Exclude events occurring strictly within the maintenance window (e.g., 01:00–05:00) on non-interactive sessions.Scenario: Installation of Tencent Cloud Security Suite