Chinese Hacktool Set - file svu.exe

Hunt Hypothesis

This detection identifies the presence of svu.exe, a known component of the Chinese Hacktool set often associated with advanced persistent threat groups conducting reconnaissance or data exfiltration activities within Azure environments. Proactively hunting for this artifact is critical because its low severity classification may cause it to be overlooked in standard alerting, allowing adversaries to establish a foothold before initiating more aggressive attack phases.

YARA Rule

rule OtherTools_servu {
	meta:
		description = "Chinese Hacktool Set - file svu.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5c64e6879a9746a0d65226706e0edc7a"
	strings:
		$s0 = "MZKERNEL32.DLL" fullword ascii
		$s1 = "UpackByDwing@" fullword ascii
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "WriteFile" fullword ascii
	condition:
		$s0 at 0 and filesize < 50KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file svu.exe detection rule, tailored for a legitimate enterprise environment:

• Scheduled Antivirus Definition Updates via Symantec Endpoint Protection

  • Scenario: The svu.exe process is frequently spawned by Symantec Endpoint Protection (SEP) during its nightly scheduled scan or definition update cycle. In many Chinese enterprise deployments, the SEP client utilizes svu.exe as a helper utility to verify file integrity and manage local quarantine databases before pushing updates from the central management server.
  • Filter/Exclusion: Exclude svu.exe when the parent process is Symantec Endpoint Protection Client (e.g., rtvscan.exe or ccSvcHst.exe) AND the file path matches the standard installation directory: C:\Program Files\Symantec\Symantec Endpoint Protection\.

• Automated Patch Management via SCCM/MECM Deployment

  • Scenario: During a Windows Update deployment orchestrated by Microsoft System Center Configuration Manager (SCCM), the deployment agent may extract and execute svu.exe as part of a specific vendor package for Chinese localization tools or hardware drivers. This often occurs when deploying firmware updates for Lenovo or Dell devices common in APAC regions, where svu.exe acts as a silent installer component.
  • Filter/Exclusion: Create an exclusion rule for svu.exe executions initiated by the SCCM agent process (ccmexec.exe) specifically within the temporary deployment folder: C:\Windows\CCMCache\*.

• Legacy Chinese ERP System Maintenance Tasks

  • Scenario: Enterprises utilizing legacy ERP systems (such as Kingdee or Yonyou) often run a background maintenance utility named svu.exe to synchronize local database caches with the central server. This process