Chinese Hacktool Set - file MarathonTool.exe

Hunt Hypothesis

This detection identifies the presence of MarathonTool.exe, a known Chinese hacktool often deployed by threat actors to establish persistence and conduct reconnaissance within compromised environments. Proactively hunting for this artifact in Azure Sentinel is critical because its low-severity classification may cause it to be overlooked during routine monitoring, allowing adversaries to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule MarathonTool {
	meta:
		description = "Chinese Hacktool Set - file MarathonTool.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
	strings:
		$s0 = "MarathonTool" ascii
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1040KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file MarathonTool.exe detection rule, including suggested filters and exclusions:

• Scenario 1: Legitimate Deployment of Marathon Tooling Suite

  • Context: The organization utilizes a legitimate Chinese-developed DevOps or monitoring suite named “Marathon” (e.g., for container orchestration or performance tracking) where the primary executable is MarathonTool.exe. This file may be deployed to application servers or jump hosts during routine patching cycles.
  • Suggested Filter/Exclusion: Create an exclusion based on the File Hash of the known good version of MarathonTool.exe and restrict the scope to specific Application Directories (e.g., C:\Program Files\Marathon Suite\bin\) rather than generic user folders.

• Scenario 2: Scheduled Administrative Maintenance Job

  • Context: A scheduled Task Scheduler job named “Monthly Security Audit” runs on domain controllers to execute a custom script that invokes MarathonTool.exe for log aggregation or system health checks. This activity generates file creation and execution events during off-hours (e.g., Sundays at 02:00 AM) which may mimic the behavior of a new, unknown tool being introduced by an attacker.
  • Suggested Filter/Exclusion: Add an exclusion for processes launched specifically by the Task Scheduler Service (svchost.exe with TaskScheduler service) or filter based on the Scheduled Task Name (e.g., include only if the parent process is schtasks.exe and the task name contains “Maintenance”).

• Scenario 3: Endpoint Protection Agent Updates

  • Context: The enterprise uses a third-party EDR solution that includes a module named “Marathon” for behavioral analysis. During an agent update cycle, the