Chinese Hacktool Set - file ipsearcher.dll

Hunt Hypothesis

This hunt targets adversaries deploying the ipsearcher.dll component of a Chinese hacktool suite to establish persistent reconnaissance capabilities within Azure Sentinel environments. Proactive hunting is essential because this low-severity artifact often evades standard alerting thresholds while serving as an early indicator of sophisticated, region-specific supply chain or insider threats.

YARA Rule

rule ipsearcher {
	meta:
		description = "Chinese Hacktool Set - file ipsearcher.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
	strings:
		$s0 = "http://www.wzpg.com" fullword ascii
		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" fullword ascii
		$s3 = "_GetAddress" fullword ascii
		$s5 = "ipsearcher.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 140KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file ipsearcher.dll detection rule, including suggested filters and exclusions:

Legitimate Deployment of “IP Searcher” Utility by IT Operations
- Scenario: The internal Network Operations Center (NOC) deploys a custom or third-party utility named ipsearcher.exe (often used for IP address conflict detection and subnet mapping) across Windows 10/11 endpoints via SCCM. This tool dynamically loads the ipsearcher.dll library into its process memory during startup to perform active network scanning, triggering the alert on the DLL creation or loading event.
- Filter/Exclusion: Create an exclusion for the parent process name ipsearcher.exe located in a trusted administrative path (e.g., C:\Program Files\IT_Ops\NetworkTools\). Additionally, filter events where the file hash of ipsearcher.dll matches a known benign baseline stored in your CMDB.
Scheduled Maintenance Job by “Advanced IP Scanner” or Similar Network Auditing Tools
- Scenario: A scheduled Task Scheduler job runs nightly to audit network connectivity using tools like Faronics Deep Freeze, ManageEngine OpManager, or SolarWinds NPM. These agents often utilize a component named ipsearcher.dll (or a similarly named internal library) to query active hosts. The detection triggers when the scheduled task service (TaskScheduler) spawns the agent process which loads this DLL during the maintenance window.
- Filter/Exclusion: Exclude events where the parent process is associated with known network management suites (e.g., OpManagerAgent.exe, SolarWinds.Agent.exe). Implement a time-based filter to suppress alerts for this specific file if it only occurs between 02:00 and 04:00 UTC,