Chinese Hacktool Set - file pw-inspector.exe

Hunt Hypothesis

This hunt targets adversaries deploying the pw-inspector.exe tool from the Chinese Hacktool set to perform credential harvesting and system reconnaissance within Azure environments. Proactive hunting is essential because this specific artifact often indicates early-stage lateral movement by advanced persistent threats that may evade standard signature-based detections due to its low severity classification.

YARA Rule

rule pw_inspector_2 {
	meta:
		description = "Chinese Hacktool Set - file pw-inspector.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
	strings:
		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
		$s3 = "PW-Inspector" fullword ascii
		$s4 = "i:o:m:M:c:lunps" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file pw-inspector.exe detection rule, including suggested filters or exclusions:

• Scenario: Deployment of Enterprise Password Auditing Suites

  • Context: Legitimate IT security teams often deploy third-party tools (e.g., Nessus, Qualys, or ManageEngine Desktop Central) that include a module named pw-inspector.exe to scan for weak passwords, password reuse, and policy compliance across the domain. This file is frequently executed during scheduled weekly audits initiated by the System Administrator account (DOMAIN\Admin).
  • Filter/Exclusion: Create an exclusion rule based on the Parent Process Name (e.g., Nessus.exe, QualysAgent.exe) or the User Account running the process. Specifically, exclude alerts where the parent process is a known security management tool and the user belongs to the “Security Operations” group.

• Scenario: Scheduled Maintenance by Patch Management Tools

  • Context: During monthly maintenance windows, patch management solutions like Ivanti Endpoint Manager, SCCM (System Center Configuration Manager), or Jamf Pro may extract and execute pw-inspector.exe as part of a post-patch verification routine. This tool checks if recent OS updates have altered password hashing algorithms or reset local service accounts.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts occurring during defined maintenance windows (e.g., Sundays 02:00–04:00 UTC). Additionally, exclude the specific hash of pw-inspector.exe if it matches the known signature of the vendor’s official release (e.g., verify against a whitelist of SHA-256 hashes for approved versions).

• Scenario: Execution via Group Policy Preferences (GPP)

  • Context: