Chinese Hacktool Set - file oncrpc.dll

Hunt Hypothesis

This hunt targets adversaries deploying the oncrpc.dll component of a Chinese hacktool suite to establish persistent remote access or execute lateral movement within the environment. Proactively hunting for this artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked by automated alerts, allowing stealthy reconnaissance activities to go undetected until they evolve into more significant incidents.

YARA Rule

rule HScan_v1_20_oncrpc {
	meta:
		description = "Chinese Hacktool Set - file oncrpc.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e8f047eed8d4f6d2f5dbaffdd0e6e4a09c5298a2"
	strings:
		$s1 = "clnt_raw.c - Fatal header serialization error." fullword ascii
		$s2 = "svctcp_.c - cannot getsockname or listen" fullword ascii
		$s3 = "too many connections (%d), compilation constant FD_SETSIZE was only %d" fullword ascii
		$s4 = "svc_run: - select failed" fullword ascii
		$s5 = "@(#)bindresvport.c" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 340KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file oncrpc.dll detection rule, including suggested filters and exclusions:

• Scenario 1: Deployment of Alibaba Cloud Security Agents (CloudTong)

  • Context: The oncrpc.dll library is a core component of the Alibaba Cloud Security Agent (often referred to as “CloudTong” or part of the Cloud Assistant suite). In enterprises utilizing Alibaba Cloud or hybrid environments, this DLL is frequently installed and updated via automated patch management tools like Ansible, SCCM (System Center Configuration Manager), or Puppet.
  • Filter/Exclusion: Exclude file creation events where the parent process name matches AliyunService.exe, CloudTongAgent.exe, or the installation command line includes msiexec with a product code associated with Alibaba Cloud. Additionally, whitelist the specific SHA-256 hash of the known good version of oncrpc.dll used in your environment.

• Scenario 2: Execution by WPS Office Suite Maintenance Tasks

  • Context: Many Chinese enterprises utilize WPS Office (Kingsoft) as their primary productivity suite instead of Microsoft Office. The oncrpc.dll file is often utilized by the WPS Update Service or the WPS Cloud Sync component to handle remote procedure calls for license validation and document synchronization. This triggers when a scheduled task runs during off-hours to check for updates.
  • Filter/Exclusion: Create an exclusion rule based on the parent process path containing \Kingsoft\WPS Office or specific executable names like wpscloud.exe, wpsupdate.exe, and wpscenter.exe. Ensure the event source is identified as a scheduled task (e.g., “WPS Auto Update”) rather than user-initiated execution.

• **Scenario 3