Chinese Hacktool Set - file hscangui.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the hscangui.exe component of a Chinese hacktool suite to establish persistence or conduct reconnaissance within Azure Sentinel environments. Proactive hunting for this specific artifact is essential because its legitimate appearance often masks early-stage supply chain compromises, allowing SOC teams to identify and isolate potential threats before they escalate into critical incidents.

YARA Rule

rule hscangui {
	meta:
		description = "Chinese Hacktool Set - file hscangui.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
	strings:
		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
		$s2 = "http://www.cnhonker.com" fullword ascii
		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 220KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - hscangui.exe detection rule, along with recommended filters or exclusions:

• Legitimate Deployment via SCCM/MECM

  • Scenario: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) to push security updates. A scheduled deployment package installs or updates the “Huawei Security Center” agent on Windows 10 endpoints, triggering hscangui.exe execution during business hours.
  • Filter/Exclusion: Create an exclusion for processes where the parent process is ccmexec.exe (SCCM Agent) and the file path matches the known installation directory (e.g., C:\Program Files\Huawei\Security Center\hscangui.exe).

• Automated Morning Health Scan via Task Scheduler

  • Scenario: A system administrator has configured a local Windows Scheduled Task named “Daily Security Integrity Check” that runs every weekday at 08:00 AM. This task launches hscangui.exe to perform a quick heuristic scan of the C: drive before users log in, generating a standard execution event.
  • Filter/Exclusion: Exclude events where the command line argument contains specific flags (e.g., -scan-mode=quick) and the process is launched by svchost.exe or TaskScheduler with a known Task Name ID matching “Daily Security Integrity Check”.

• IT Helpdesk Remote Support Session

  • Scenario: During an active ticket resolution, a Tier 2 support engineer uses a remote management tool (such as Ivanti Connect Secure or TeamViewer) to launch hscangui.exe manually on a user’s workstation to troubleshoot a specific malware alert. The manual execution is legitimate but triggers the rule due to its association with Chinese-origin security tools.