Chinese Hacktool Set - file OSEditor.exe

Hunt Hypothesis

This hunt hypothesis posits that adversaries are deploying the specific OSEditor.exe artifact from a known Chinese hacktool set to establish persistence or conduct reconnaissance within the environment. The SOC team should proactively investigate this file in Azure Sentinel because its low severity classification may cause it to be overlooked, allowing attackers to maintain a stealthy foothold before escalating their operations.

YARA Rule

rule OSEditor {
	meta:
		description = "Chinese Hacktool Set - file OSEditor.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
	strings:
		$s1 = "OSEditor.exe" fullword wide
		$s2 = "netsafe" wide
		$s3 = "OSC Editor" fullword wide
		$s4 = "GIF89" ascii
		$s5 = "Unlock" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file OSEditor.exe detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Deployment of “OS Editor” by a Local IT Vendor

  • Context: Many enterprise environments utilize third-party Chinese system management suites (e.g., from vendors like Kingsoft or local MSP tools) that include a utility named OSEditor.exe for registry tuning, startup optimization, or software inventory. This file is often deployed via Group Policy to workstations during maintenance windows.
  • Filter/Exclusion: Create an exclusion based on the File Hash (SHA-256). If the hash matches a known benign version of the vendor’s tool across the fleet, exclude all detections for that specific hash regardless of the path.

• Scenario: Scheduled Task Execution by System Administrators

  • Context: A scheduled task named Daily_System_Optimization runs under the SYSTEM or a dedicated service account (e.g., svc_it_ops) to launch OSEditor.exe from a network share (\\fileserver\tools\OS_Editor\). This is a routine administrative job that performs disk cleanup and configuration backups, not a malicious lateral movement attempt.
  • Filter/Exclusion: Exclude alerts where the Parent Process is TaskScheduler.exe (or svchost.exe running the task) AND the User Account belongs to the “IT Operations” or “System Administrators” security group, provided the execution path matches the known network share location.

• Scenario: Software Installation by Package Management Tools

  • Context: During a mass software rollout using tools like Microsoft SCCM, Ivanti Endpoint Manager, or Chocolatey, the installer extracts OSEditor.exe to a temporary folder (e.g