Chinese Hacktool Set - file NtGodMode.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the specific Chinese hacktool artifact NtGodMode.exe to establish persistence or conduct reconnaissance within the environment. Proactively hunting for this file in Azure Sentinel is critical because its presence may indicate an early-stage intrusion by a threat actor utilizing region-specific tooling, allowing the SOC team to investigate potential lateral movement before higher-severity alerts trigger.

YARA Rule

rule NtGodMode {
	meta:
		description = "Chinese Hacktool Set - file NtGodMode.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
	strings:
		$s0 = "to HOST!" fullword ascii
		$s1 = "SS.EXE" fullword ascii
		$s5 = "lstrlen0" fullword ascii
		$s6 = "Virtual" fullword ascii  /* Goodware String - occured 6 times */
		$s19 = "RtlUnw" fullword ascii /* Goodware String - occured 1 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 45KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file NtGodMode.exe detection rule in an enterprise environment:

• Legitimate Deployment of “NtGodMode” Utility by IT Operations

  • Scenario: The internal Desktop Support team deploys a custom or third-party utility named NtGodMode.exe (often used for system diagnostics, driver updates, or remote management) via their endpoint management solution. This triggers the rule when the file is written to the %TEMP% directory during a scheduled maintenance window.
  • Filter/Exclusion: Exclude files where the parent process is SCCMClient.exe, IntuneManagementExtension.exe, or WSUSAgent.exe, and the file path contains \ProgramData\Microsoft\Windows NT\GodMode\.

• Execution by Third-Party Antivirus Scanning Engines

  • Scenario: A security vendor (e.g., CrowdStrike, SentinelOne, or Symantec) utilizes a component named NtGodMode.exe as part of its heuristic scanning engine to detect legacy Chinese malware. The file is frequently spawned from the antivirus installation directory during real-time scan cycles.
  • Filter/Exclusion: Whitelist the specific SHA256 hash of the known vendor’s NtGodMode.exe binary, or exclude execution paths under C:\Program Files\<VendorName>\Security\ScanEngine\.

• Scheduled Task for Local Group Policy Optimization

  • Scenario: An automated scheduled task named “Optimize_GodMode_Settings” runs daily at 02:00 AM to apply local group policy templates. This task invokes NtGodMode.exe located in the C:\Windows\System32\GroupPolicy\Tools\ directory to synchronize user configurations across the domain.
  • **Filter/Ex