Chinese Hacktool Set - file IsDebug V1.4.dll

Hunt Hypothesis

This detection identifies the presence of a specific Chinese hacktool artifact (IsDebug V1.4.dll) that adversaries often deploy to establish persistence or facilitate debugging capabilities within compromised systems. Proactively hunting for this file in Azure Sentinel is critical because its low severity rating may cause it to be overlooked during standard alert triage, allowing attackers to maintain a stealthy foothold before executing more aggressive actions.

YARA Rule

rule IsDebug_V1_4 {
	meta:
		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
	strings:
		$s0 = "IsDebug.dll" fullword ascii
		$s1 = "SV Dumper V1.0" fullword wide
		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
		$s8 = "Error WriteMemory failed" fullword ascii
		$s9 = "IsDebugPresent" fullword ascii
		$s10 = "idb_Autoload" fullword ascii
		$s11 = "Bin Files" fullword ascii
		$s12 = "MASM32 version" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 30KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file IsDebug V1.4.dll detection rule, including suggested filters or exclusions:

• Scenario: Deployment of Chinese Language Support Packages via SCCM/Intune

  • Context: Enterprise IT teams often deploy localized versions of Microsoft Office, Adobe Creative Cloud, or ERP systems (e.g., SAP with Chinese localization) to users in APAC regions. These installers frequently bundle the IsDebug V1.4.dll library as part of their diagnostic and logging framework to ensure compatibility with Simplified/Traditional character sets.
  • Filter/Exclusion: Create an exclusion based on the parent process name matching known deployment agents (e.g., ccmexec.exe, MicrosoftEdgeUpdate.exe) or specific installation paths such as C:\Program Files\ChineseLocalizationPackages\*.

• Scenario: Execution of Third-Party Chinese Accounting Software

  • Context: Financial departments in multinational corporations often use specialized Chinese accounting tools (e.g., Kingdee, Yonyou U8, or local versions of QuickBooks) to handle tax compliance. These applications load IsDebug V1.4.dll at startup to manage real-time transaction auditing and debug logs during month-end closing cycles.
  • Filter/Exclusion: Exclude the file hash for IsDebug V1.4.dll when the parent process is a known accounting executable (e.g., Kingdee.exe, YonyouU8.exe) or restrict the rule to trigger only outside of standard business hours if these tools are typically launched manually by finance staff.

• Scenario: Automated Patch Management for Chinese Browser Extensions

  • Context: Security teams may mandate specific browsers (like Baidu Netdisk, 360 Secure Browser, or Chrome with heavy Chinese extension suites) that include built-in