Chinese Hacktool Set - file AJunk.dll

Hunt Hypothesis

This detection identifies the presence of the AJunk.dll artifact associated with a known Chinese hacktool set, which adversaries often deploy to establish persistence or conduct reconnaissance within compromised endpoints. Proactively hunting for this file in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule PLUGIN_AJunk {
	meta:
		description = "Chinese Hacktool Set - file AJunk.dll"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
	strings:
		$s1 = "AJunk.dll" fullword ascii
		$s2 = "AJunk.DLL" fullword wide
		$s3 = "AJunk Dynamic Link Library" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 560KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file AJunk.dll detection rule, along with suggested filters and exclusions:

Scenario: Deployment of “360 Total Security” or “Qihoo 360” Enterprise Endpoint Protection
- Context: Many enterprises utilize Chinese-origin security suites (e.g., Qihoo 360, Kingsoft Antivirus) which often install a core component named AJunk.dll to handle junk file cleanup and system optimization. This is frequently triggered during the initial agent installation or major version updates performed by the IT Operations team via SCCM/Intune.
- Suggested Filter: Exclude alerts where the parent process is the known installer (e.g., msiexec.exe, setup.exe) running under a privileged service account (e.g., DOMAIN\IT-Svc-Deploy) and the file path matches the vendor’s standard installation directory (e.g., C:\Program Files\Qihoo 360\...).
Scenario: Execution of “WPS Office” Maintenance or Update Tasks
- Context: In organizations using WPS Office as a Microsoft Office alternative, the suite includes a background maintenance module that utilizes AJunk.dll to manage cache and temporary files. This triggers when the scheduled task WPS Office Update Service runs nightly to clear user caches on workstations.
- Suggested Filter: Create an exclusion for file creation or modification events where the parent process is wpscloud.exe or wpsupdate.exe, specifically targeting the path C:\Users\*\AppData\Local\Kingsoft\WPS Office\....
Scenario: Scheduled “Disk Cleanup” Scripts utilizing Custom Chinese Utility Libraries
- Context: System administrators often deploy custom PowerShell or batch scripts to