Chinese Hacktool Set - file HTTPSCANNER.EXE

Hunt Hypothesis

This hunt targets adversaries deploying the HTTPSCANNER.EXE reconnaissance tool to map network infrastructure and identify potential entry points within the Azure environment. Proactively hunting for this specific artifact is critical because its presence often signals early-stage information gathering by threat actors associated with Chinese hacktool sets, allowing the SOC team to investigate lateral movement before more aggressive exploitation occurs.

YARA Rule

rule HTTPSCANNER {
	meta:
		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
	strings:
		$s1 = "HttpScanner.exe" fullword wide
		$s2 = "HttpScanner" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 3500KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file HTTPSCANNER.EXE detection rule, tailored for an enterprise environment:

• Scheduled Vulnerability Scans by Qualys or Tenable

  • Scenario: Enterprise vulnerability management platforms (e.g., Qualys Cloud Agent or Tenable Nessus) often deploy a lightweight HTTP scanner module named HTTPSCANNER.EXE to perform routine port and service discovery on endpoints. This activity is triggered daily during off-hours by the central management console, not by user interaction.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name (e.g., qualysagent.exe, tenable_agent_service.exe) or the User Account running the job (e.g., DOMAIN\svc-vuln-scan).

• Endpoint Protection Web Traffic Analysis by Sophos or Symantec

  • Scenario: Next-Generation Antivirus solutions like Sophos Intercept X or Symantec Endpoint Protection utilize a dedicated HTTP scanning engine to inspect web traffic for malware before it reaches the browser. This executable is frequently spawned as a child process of the main security service (SophosService.exe or Symantec AntiVirus) during real-time protection updates.
  • Filter/Exclusion: Exclude events where the Parent Process Name matches known EDR/Antivirus services (e.g., contains “Sophos”, “Symantec”, “McAfee”) and the File Hash matches a known baseline hash for the vendor’s specific version of HTTPSCANNER.EXE.

• Automated Compliance Audits by Microsoft System Center Configuration Manager (SCCM)

  • Scenario: During automated compliance checks or software inventory sweeps, SCCM may deploy a custom discovery script that includes HTTPSCANNER.EXE to verify the status of