Chinese Hacktool Set - file kappfree.dll

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the kappfree.dll component of a Chinese hacktool suite to establish persistence or conduct reconnaissance within Azure workloads. Proactive hunting for this artifact is essential because its low-severity classification may cause it to be overlooked by automated alerts, allowing attackers to maintain an undetected foothold before escalating their activities.

YARA Rule

rule kappfree_2 {
	meta:
		description = "Chinese Hacktool Set - file kappfree.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
	strings:
		$s1 = "kappfree.dll" fullword ascii
		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
		$s3 = "' introuvable !" fullword wide
		$s4 = "kiwi\\mimikatz" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file kappfree.dll detection rule in an enterprise environment, along with suggested filters or exclusions:

Scenario: Deployment of “KAppFree” Enterprise Asset Management Suite
- Context: The organization utilizes a legitimate third-party asset management and software distribution tool named “KAppFree” (or a similarly named internal wrapper) to manage license compliance across Windows endpoints. During the scheduled nightly update cycle, the kappfree.dll module is injected into the memory of user sessions to perform inventory scans.
- Suggested Filter/Exclusion: Create an exclusion for processes originating from the specific vendor’s signed certificate hash (e.g., KAppFree Inc.) and restrict the detection scope to file paths located within C:\Program Files\KAppFree Enterprise\ or C:\ProgramData\KAppFree\.
Scenario: Execution of Custom PowerShell Maintenance Scripts by IT Operations
- Context: The IT Operations team runs a custom PowerShell script (Invoke-AssetSync.ps1) via Task Scheduler to synchronize local application data with the central repository. This script dynamically loads kappfree.dll as a .NET assembly to parse XML configuration files before executing cleanup routines on domain-joined workstations during business hours.
- Suggested Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or svchost.exe and the command line arguments contain specific keywords like -ExecutionPolicy Bypass or references to the internal script path (e.g., C:\Scripts\Ops\Maintenance\).
Scenario: Installation of “K-App Free” Browser Extension Manager
- Context: The enterprise has standardized on a browser extension management solution called “K-App Free” to enforce security policies for Chrome and Edge