Chinese Hacktool Set - file SQLTools.exe

Hunt Hypothesis

This detection identifies the presence of SQLTools.exe, a known component of the Chinese Hacktool set often deployed by adversaries to establish persistence and conduct data discovery within targeted environments. Proactively hunting for this artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing threat actors to maintain a covert foothold before escalating their activities.

YARA Rule

rule SQLTools {
	meta:
		description = "Chinese Hacktool Set - file SQLTools.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
	strings:
		$s1 = "DBN_POST" fullword wide
		$s2 = "LOADER ERROR" fullword ascii
		$s3 = "www.1285.net" fullword wide
		$s4 = "TUPFILEFORM" fullword wide
		$s5 = "DBN_DELETE" fullword wide
		$s6 = "DBINSERT" fullword wide
		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 2350KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - SQLTools.exe detection rule, including context and recommended exclusions:

• Scenario: Microsoft SQL Server Management Studio (SSMS) Deployment or Updates

  • Context: During scheduled maintenance windows or new server provisioning, IT administrators often install or patch SSMS. The installation package frequently extracts SQLTools.exe as part of the core utility suite to configure database connections and manage service accounts before the main engine starts.
  • Filter/Exclusion: Create an exclusion for SQLTools.exe executing from the standard Microsoft installation directory (e.g., C:\Program Files\Microsoft SQL Server Management Studio\*) or exclude events where the parent process is Setup.exe or msiexec.exe with a known Microsoft publisher signature.

• Scenario: Automated Database Health Checks via Scheduled Tasks

  • Context: Enterprise environments often run nightly scripts to verify database connectivity, check log file sizes, and validate backup integrity. These tasks are frequently triggered by Windows Task Scheduler using SQLTools.exe as the executable entry point to query system health metrics without user interaction.
  • Filter/Exclusion: Exclude alerts where the process is launched by TaskSchedulerService (svchost.exe) or schtasks.exe, specifically targeting known task names such as “DB_Health_Check,” “Daily_Backup_Verification,” or any task running under a dedicated service account (e.g., svc_db_monitor) rather than an interactive user.

• Scenario: Third-Party Database Migration and ETL Tools

  • Context: Organizations utilizing data integration platforms like Talend, Informatica, or custom PowerShell-based ETL pipelines often bundle SQLTools.exe to handle schema synchronization and data validation during migration projects. These tools invoke the executable repeatedly in batch mode to process large