Chinese Hacktool Set - file PipeCmd.exe

Hunt Hypothesis

This detection targets adversaries utilizing the PipeCmd.exe utility to establish covert command-and-control channels or execute lateral movements within Azure environments. Proactive hunting for this specific artifact is critical because its legitimate appearance often masks persistent Chinese threat actor activity that may evade standard signature-based alerts due to its low severity classification.

YARA Rule

rule HScan_v1_20_PipeCmd {
	meta:
		description = "Chinese Hacktool Set - file PipeCmd.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "64403ce63b28b544646a30da3be2f395788542d6"
	strings:
		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
		$s2 = "PipeCmd.exe" fullword wide
		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
		$s9 = "PIPECMDSRV" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file PipeCmd.exe detection rule, along with suggested filters or exclusions:

• Scenario: Legitimate Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM agent (ccmexec.exe) frequently deploys custom PowerShell scripts or third-party utilities to client machines. If an organization uses a legitimate Chinese management utility named PipeCmd.exe for network diagnostics, the deployment of this file from the Software Distribution point will trigger the rule.
  • Filter/Exclusion: Exclude file creation events where the parent process is ccmexec.exe and the source path contains \Microsoft\CCM\. Additionally, whitelist the specific SHA-256 hash of the known legitimate PipeCmd.exe binary used in your environment.

• Scenario: Scheduled Maintenance Job for Database Connectivity

  • Context: A scheduled Task (Task Scheduler) runs nightly to verify connectivity between SQL Server instances and remote Chinese branch offices using a custom wrapper tool named PipeCmd.exe. This job executes under the context of System or a dedicated service account, creating temporary log files or configuration updates with this name.
  • Filter/Exclusion: Create an exclusion for events where the parent process is svchost.exe (specifically the Schedule service) and the user principal name matches the known maintenance service account (e.g., svc-db-maint).

• Scenario: Third-Party IT Asset Management Scanning

  • Context: Enterprise asset management tools like SolarWinds RMM, ManageEngine Endpoint Central, or Ivanti often utilize local agents to scan hardware and software inventories. These agents may drop a helper executable named PipeCmd.exe in the %TEMP% directory during an inventory sweep to parse pipe-based data