Chinese Hacktool Set - file OracleScan.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the OracleScan.exe tool to conduct reconnaissance or establish persistence within Windows environments, leveraging a known Chinese hacktool signature for stealthy operations. A proactive hunt in Azure Sentinel is essential to identify early-stage lateral movement and validate whether this low-severity artifact represents benign administrative activity or an initial foothold for a more sophisticated campaign.

YARA Rule

rule OracleScan {
	meta:
		description = "Chinese Hacktool Set - file OracleScan.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
	strings:
		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
		$s2 = "\\Borland\\Delphi\\RTL" fullword ascii
		$s3 = "USER_NAME" ascii
		$s4 = "FROMWWHERE" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file OracleScan.exe detection rule in an enterprise environment, along with suggested filters:

• Oracle Database Patching and Maintenance Jobs

  • Scenario: During scheduled maintenance windows (e.g., early morning), the Oracle Enterprise Manager or automated patching scripts execute OracleScan.exe to audit database configurations, check for vulnerabilities, and verify listener status. This is a standard administrative task often triggered by Windows Task Scheduler on server groups running Oracle Database 19c/21c.
  • Suggested Filter: Exclude the rule trigger if the process path matches C:\Program Files\Oracle\* or D:\Oracle\Middleware\*, and the parent process is svchost.exe (specifically the “Task Scheduler” service) or a known Oracle service executable like emctl.exe.

• Third-Party Endpoint Protection Scans

  • Scenario: Enterprise endpoint security suites, such as CrowdStrike Falcon, Trend Micro Deep Security, or Symantec Endpoint Protection, may launch a custom heuristic scan module named OracleScan.exe to specifically inspect Oracle installation directories for known malware signatures without triggering the main AV engine. This often occurs during daily scheduled scans on workstations and servers with heavy database usage.
  • Suggested Filter: Whitelist OracleScan.exe when the parent process is a recognized security vendor executable (e.g., C:\Program Files\CrowdStrike\fsa.exe, TmAgent.exe, or rtvscan.exe) and the file hash matches the known benign version deployed by the IT Security team.

• Legacy Application Deployment via SCCM/Intune

  • Scenario: In environments utilizing Microsoft Endpoint Configuration Manager (MECM) or Microsoft Intune, a deployment package for an