Chinese Hacktool Set - file SQL.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the specific “SQL.exe” artifact from the Chinese Hacktool set to establish persistence or conduct reconnaissance within Azure workloads. Proactively hunting for this low-severity indicator is critical because its generic naming convention often allows it to evade standard signature-based defenses, requiring behavioral analysis to distinguish legitimate database tools from malicious activity in the Sentinel environment.

YARA Rule

rule sql1433_SQL {
	meta:
		description = "Chinese Hacktool Set - file SQL.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
	strings:
		/* WIDE: ProductName 1433 */
		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
		/* WIDE: ProductVersion 1,4,3,3 */
		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
	condition:
		uint16(0) == 0x5a4d and filesize < 90KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file SQL.exe detection rule, including suggested filters and exclusions:

• Microsoft SQL Server Management Studio (SSMS) Deployment Tasks

  • Scenario: Administrators frequently use SSMS or PowerShell scripts to deploy database updates. During these operations, a legitimate temporary executable named SQL.exe is often generated in the %TEMP% folder or the installation directory (C:\Program Files\Microsoft SQL Server) to handle connection pooling or query execution before being renamed or moved by the deployment pipeline.
  • Filter/Exclusion: Create an exclusion for files located specifically within C:\Program Files\Microsoft SQL Server\* and C:\Users\<AdminUser>\AppData\Local\Temp\SQL.exe. Additionally, filter based on the parent process being sqlps.exe, ssms.exe, or powershell.exe with a known Microsoft code signature.

• Third-Party Database Monitoring Agents (e.g., SolarWinds or Datadog)

  • Scenario: Enterprise monitoring solutions often install lightweight agents that perform real-time SQL health checks. These agents may spawn a helper process named SQL.exe to execute specific T-SQL queries against the database engine without invoking the full SQL Server service, mimicking the behavior of a Chinese hacktool utility.
  • Filter/Exclusion: Exclude instances where the file path contains known vendor directories such as C:\Program Files\SolarWinds\*, C:\Program Files\Datadog\Agent\*, or C:\ProgramData\<VendorName>\. Ensure the exclusion requires a valid digital signature from the respective monitoring vendor (e.g., SolarWinds Corporation, Datadog).

• Scheduled Maintenance Jobs via Windows Task Scheduler

  • Scenario: IT operations teams configure scheduled tasks