Chinese Hacktool Set - file Project1.exe

Hunt Hypothesis

This detection identifies the execution of “Project1.exe,” a known artifact associated with Chinese hacktool sets that may indicate reconnaissance or lateral movement activities by state-sponsored adversaries. Proactively hunting for this specific file in Azure Sentinel is critical to validate its legitimacy and uncover potential early-stage intrusions before they escalate into significant security incidents.

YARA Rule

rule Project1 {
	meta:
		description = "Chinese Hacktool Set - file Project1.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
	strings:
		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
		$s2 = "Password.txt" fullword ascii
		$s3 = "LoginPrompt" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 5000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Project1.exe detection rule in an enterprise environment:

Software Deployment via SCCM/MECM: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager pushes a custom application installer named Project1.exe to endpoints during the “Business Hours” maintenance window. This executable is often used as a generic wrapper for internal line-of-business applications developed by the IT department, triggering the alert upon file creation and execution in the %ProgramFiles% directory.
- Suggested Filter: Create an exclusion for Project1.exe when executed from the path C:\Program Files\InternalApps\* or C:\Windows\CCMCache\*, provided the parent process is ccmexec.exe.
Automated Backup and Archiving Jobs: A scheduled Task (Task Scheduler) runs a nightly backup utility developed by a third-party vendor, which uses Project1.exe as its primary executable to compress and archive logs from critical servers. This job typically runs at 02:00 AM under the context of the SYSTEM or a dedicated service account (svc_backup).
- Suggested Filter: Exclude events where the parent process is svchost.exe (specifically the TaskScheduler service) or schtasks.exe, and the file path matches C:\Scripts\BackupTools\Project1.exe.
Endpoint Protection Scanning Updates: The organization utilizes a Chinese-origin endpoint security suite (e.g., Kingsoft, Qihoo 360, or Tencent PC Manager) which periodically downloads and executes a module named Project1.exe to perform heuristic scanning or update the local threat intelligence database. This is common in enterprises with significant operations in Asia or those utilizing multi-vendor security stacks.
- Suggested Filter: Whit