Chinese Hacktool Set - file scanms.exe

Hunt Hypothesis

This detection targets adversaries deploying the scanms.exe utility from the Chinese Hacktool set to perform system reconnaissance and establish a foothold within Azure environments. Proactive hunting for this specific artifact is essential because its legitimate appearance often masks early-stage lateral movement activities that may evade standard signature-based alerts in Azure Sentinel.

YARA Rule

rule scanms_scanms {
	meta:
		description = "Chinese Hacktool Set - file scanms.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
	strings:
		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii /* PEStudio Blacklist: os */
		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
		$s5 = "Internet Explorer 1.0" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file scanms.exe detection rule in an enterprise environment, along with recommended filters or exclusions:

• Scenario: Legitimate Microsoft Defender Antivirus Scans via Scheduled Task

  • Context: The scanms.exe process is often a component of Microsoft Defender (or legacy Microsoft Security Essentials) performing routine background scans. In many Chinese enterprise deployments, this executable is triggered by the “Microsoft Defender Antivirus” scheduled task (\Microsoft\Windows Defender\MpCmdRun) running under the SYSTEM or NT AUTHORITY\LOCAL SERVICE account.
  • Filter/Exclusion: Exclude events where the parent process is MpCmdRun.exe (or MsMpEng.exe) and the user context is a system service account. Additionally, filter by file path: ensure the executable resides in %ProgramFiles%\Windows Defender\ or %SystemRoot%\System32\.

• Scenario: Deployment of Third-Party Endpoint Protection Agents

  • Context: Many organizations utilize Unified Threat Management (UTM) solutions or EDR agents (e.g., Symantec, McAfee, or Trend Micro) that bundle a scanms.exe utility for on-demand scanning modules. This often occurs during the initial agent installation phase or when a “Quick Scan” is triggered by an IT administrator via Group Policy.
  • Filter/Exclusion: Create an exclusion based on the file’s digital signature publisher. Whitelist instances where the certificate issuer matches known enterprise security vendors (e.g., “Symantec Corporation,” “Trend Micro Inc.”) and the file hash matches a baseline of approved EDR components deployed via SCCM or Intune.

• Scenario: Automated Patch Management and Compliance Scanning

  • Context: Enterprise patch management tools like **Microsoft Endpoint Configuration Manager