Chinese Hacktool Set - file MarathonTool.exe

Hunt Hypothesis

This detection identifies the presence of MarathonTool.exe, a known Chinese hacktool often deployed for system diagnostics but potentially leveraged by adversaries to establish persistence or gather reconnaissance data within Azure environments. Proactively hunting for this file is critical because its benign classification may allow threat actors to operate under the radar, enabling early discovery of unauthorized tooling before it escalates into a broader compromise.

YARA Rule

rule MarathonTool_2 {
	meta:
		description = "Chinese Hacktool Set - file MarathonTool.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
	strings:
		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file MarathonTool.exe detection rule in an enterprise environment:

• IT Asset Management & Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team utilizes a third-party asset management suite (e.g., LanDesk or SolarWinds RMM) that periodically deploys a lightweight Chinese utility named MarathonTool.exe to endpoints. This tool is used specifically for inventorying localized software configurations and checking regional compliance settings on workstations within the APAC division. The file is executed from a standard deployment path (e.g., C:\Program Files\AssetManager\Tools\) rather than a temporary folder, yet triggers the rule due to its known hash signature matching the threat intelligence feed for Chinese hacktools.
  • Filter/Exclusion: Create an exclusion based on the file’s full path (C:\Program Files\AssetManager\Tools\MarathonTool.exe) and restrict the alert to only trigger if the parent process is not a trusted deployment agent (e.g., ccmexec.exe or IntuneAgent.exe).

• Scheduled Regional Compliance Audit Job

  • Scenario: A scheduled task runs every Tuesday at 02:00 AM on domain-joined servers to perform a regional compliance check. This job invokes MarathonTool.exe, which is part of the organization’s internal “China Data Residency” monitoring package. The tool scans for specific registry keys and file permissions required by local regulations. Because this execution occurs outside standard business hours and originates from a dedicated service account (svc_compliance_audit), it generates high-volume alerts that are benign but flagged as suspicious activity due to the tool’s origin classification.
  • Filter/Exclusion: Implement a filter to suppress alerts where the user context is NT AUTHORITY\SYSTEM or