Chinese Hacktool Set - file hscan-gui.exe

Hunt Hypothesis

This hunt investigates the presence of hscan-gui.exe, a known Chinese hacktool executable often associated with supply chain compromises or lateral movement activities within Azure environments. Proactively searching for this artifact is critical to identify potential early-stage reconnaissance or unauthorized tool deployment before it escalates into a higher-severity incident, even when initial alerts are marked as low severity.

YARA Rule

rule hscan_gui {
	meta:
		description = "Chinese Hacktool Set - file hscan-gui.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
	strings:
		$s0 = "Hscan.EXE" fullword wide
		$s1 = "RestTool.EXE" fullword ascii
		$s3 = "Hscan Application " fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 550KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file hscan-gui.exe detection rule, including suggested filters and exclusions:

• Legitimate Endpoint Protection Deployment via SCCM/Intune

  • Scenario: The organization uses a Chinese endpoint security suite (e.g., Kingsoft Antivirus or 360 Total Security) deployed across the enterprise. During scheduled maintenance windows, the hscan-gui.exe process is launched by System Center Configuration Manager (SCCM) or Microsoft Intune to perform on-demand full system scans and update virus definitions.
  • Suggested Filter: Exclude events where the parent process is ccmexec.exe (SCCM Client) or IntuneManagementExtension.exe, specifically occurring between 02:00 and 04:00 UTC.

• IT Helpdesk Remote Troubleshooting Sessions

  • Scenario: IT Support analysts utilize a remote management tool (such as AnyDesk, TeamViewer, or LogMeIn) to connect to user workstations for troubleshooting. As part of the diagnostic script, they manually launch hscan-gui.exe to verify local security status and scan specific folders requested by the end-user.
  • Suggested Filter: Create an exclusion for executions originating from known IT Service Account identities (e.g., DOMAIN\IT-Support-Group) or where the command line arguments include flags like -manual-scan or -diagnostic-mode.

• Automated Compliance Auditing Scheduled Task

  • Scenario: A scheduled Windows Task is configured to run daily at 09:00 AM to generate compliance reports for internal security audits. This task triggers hscan-gui.exe in a silent mode (-silent) to scan critical data directories and output logs to the SIEM, mimicking the behavior of an active threat