Chinese Hacktool Set - file ms11011.exe

Hunt Hypothesis

This detection identifies the execution of ms11011.exe, a known artifact associated with Chinese hacktool sets that may indicate reconnaissance or persistence activities by state-sponsored actors. Proactively hunting for this file in Azure Sentinel is critical to distinguish legitimate maintenance tasks from potential supply chain compromises, ensuring early visibility into adversary footholds before they escalate.

YARA Rule

rule GoodToolset_ms11011 {
	meta:
		description = "Chinese Hacktool Set - file ms11011.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
	strings:
		$s0 = "\\i386\\Hello.pdb" ascii
		$s1 = "OS not supported." fullword ascii
		$s3 = "Not supported." fullword wide  /* Goodware String - occured 3 times */
		$s4 = "SystemDefaultEUDCFont" fullword wide  /* Goodware String - occured 18 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file ms11011.exe detection rule in an enterprise environment:

• Microsoft Office Click-to-Run Updates

  • Scenario: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) frequently extracts or executes ms11011.exe during scheduled monthly updates for the 365 suite. This executable is often a temporary payload used to verify installation integrity before being deleted, mimicking the behavior of the Chinese Hacktool.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where ms11011.exe is spawned by the parent process OfficeClickToRun.exe or resides within the %ProgramFiles%\Microsoft Office\root\office16\ directory path.

• Endpoint Protection Agent Self-Scans

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, often utilize ms11011.exe as a helper utility during their daily scheduled “Quick Scan” or “On-Demand Scan.” The agent launches this file to perform specific registry checks or network connectivity tests that match the hacktool’s signature.
  • Filter/Exclusion: Exclude events where the parent process is MsMpEng.exe (Defender) or CrowdStrikeService.exe, and the execution time aligns with the organization’s defined maintenance window (e.g., 02:00–04:00 local time).

• Automated Patch Management Deployments

  • Scenario: During automated software deployment cycles using tools like SCCM (System Center Configuration Manager) or Ivanti, the ms11011.exe file is often deployed as a prerequisite installer for specific Chinese-language applications or