Chinese Hacktool Set - file kappfree.dll

Hunt Hypothesis

This hunt targets adversaries deploying the kappfree.dll component of a Chinese hack tool suite to establish persistence or execute reconnaissance activities within Windows endpoints. Proactively hunting for this artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked by automated alerts, allowing stealthy initial footholds to evolve into significant compromises before detection.

YARA Rule

rule kappfree {
	meta:
		description = "Chinese Hacktool Set - file kappfree.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "kappfree.dll" fullword ascii
		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - kappfree.dll detection rule in an enterprise environment:

• Deployment of Third-Party “AppFree” Utility by IT Operations

  • Scenario: The IT department deploys a legitimate Chinese productivity suite (often named “AppFree” or similar) to regional offices. This utility installs kappfree.dll into the C:\Program Files\AppFree\Bin directory and registers it as a background service for system optimization, triggering the detection upon installation or first run.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the file path contains \AppFree\ AND the file hash matches the known good SHA-256 of the vendor-signed binary. Additionally, exclude events generated by the System or specific Service Accounts (e.g., svc-deployment) during standard maintenance windows.

• Execution via Scheduled Task for Regional Compliance Reporting

  • Scenario: A scheduled task named “Regional_Compliance_Scan” runs nightly on Windows 10/11 endpoints in the APAC region. This task invokes a script that loads kappfree.dll to extract usage metrics from local applications, causing the detection logic to flag the DLL load as suspicious activity due to its association with Chinese tooling.
  • Filter/Exclusion: Filter alerts where the parent process is TaskScheduler.exe (or svchost.exe running under the “Local Service” account) AND the command line arguments include a reference to the specific scheduled task name (Regional_Compliance_Scan).

• Software Installation via SCCM or Intune Management

  • Scenario: During a monthly patch cycle, Microsoft Endpoint Configuration Manager (SCCM) or Intune pushes an update package for a Chinese language input method or security helper. The installer extracts