Chinese Hacktool Set - file ms11080_withcmd.exe

Hunt Hypothesis

This detection targets adversaries deploying a specific Chinese hacktool that leverages ms11080_withcmd.exe to execute commands and potentially establish persistence on endpoints. Proactively hunting for this artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule ms11080_withcmd {
	meta:
		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
	strings:
		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" fullword ascii
		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
		$s4 = "[>] create porcess error" fullword ascii
		$s5 = "[>] ms11-080 Exploit" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file ms11080_withcmd.exe detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Office Click-to-Run Deployment Updates

  • Context: The ms11080 identifier is often associated with Microsoft security updates or deployment tools. In an enterprise environment using Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune, the Office Click-to-Run service frequently executes cmd.exe to apply patches or configure local policies during scheduled maintenance windows.
  • Suggested Filter: Create a rule exclusion for processes where the parent process is OfficeClickToRun.exe or ccmexec.exe, and the command line arguments contain references to Microsoft Office 365 or specific update KB numbers (e.g., KB401234).

• Scenario: Scheduled Group Policy Preference (GPP) Execution

  • Context: Administrators often configure Group Policy Preferences to run local scripts at user logon or system startup. A common task involves a scheduled job running via the Task Scheduler (taskschd.msc) that invokes cmd.exe to execute a batch script located in the C:\Windows\System32\GroupPolicy\Machine\Scripts directory, which may generate the specific file hash associated with this rule.
  • Suggested Filter: Exclude events where the User Account is the built-in SYSTEM or NT AUTHORITY\Network Service, and the execution path starts with C:\Windows\System32\GroupPolicy.

• Scenario: Enterprise Software Patching (e.g., Ivanti or ManageEngine)

  • Context: Third-party patch management tools like Ivanti Endpoint Manager or ManageEngine Desktop Central often utilize