Chinese Hacktool Set - file Sword1.5.exe

Hunt Hypothesis

This detection identifies the presence of the “Sword1.5.exe” executable, a known component of the Chinese Hacktool set often associated with supply chain espionage or advanced persistent threat activities targeting Azure environments. Proactively hunting for this file is critical to validate its legitimacy and distinguish between authorized deployment and potential lateral movement by adversaries leveraging familiar tooling to evade standard signature-based alerts.

YARA Rule

rule Sword1_5 {
	meta:
		description = "Chinese Hacktool Set - file Sword1.5.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
	strings:
		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
		$s6 = "ListBox_Command" fullword wide
		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
		$s18 = "\\Set.ini" fullword wide
		$s19 = "OpenFileDialog1" fullword wide
		$s20 = " (*.txt)|*.txt" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 400KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Sword1.5.exe detection rule in an enterprise environment:

• Endpoint Security Agent Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a Chinese-language security agent or system utility (often used by subsidiaries in APAC regions) named Sword1.5.exe to endpoints using Microsoft Endpoint Configuration Manager (SCCM) or Intune. During the scheduled deployment window, the installer executes the binary, triggering the detection as it scans the file hash against known threat intelligence feeds that flag this specific artifact.
  • Filter/Exclusion: Create a process exclusion for Sword1.5.exe when the parent process is ccmexec.exe (SCCM) or Microsoft.Windows.Search.exe / IntuneManagementExtension.exe. Additionally, whitelist the file hash if it matches the known benign version deployed by your organization.

• Automated Patch Management for Chinese ERP Modules

  • Scenario: A scheduled Task Scheduler job runs nightly to apply patches for a localized Enterprise Resource Planning (ERP) module (e.g., Kingdee or Yonyou systems). The patch installer launches Sword1.5.exe as a prerequisite tool to verify system integrity before applying updates. This execution occurs during off-hours and is initiated by the “System” account, but the detection rule flags the file creation/execution event.
  • Filter/Exclusion: Exclude events where the user context is NT AUTHORITY\SYSTEM or Local Service AND the parent process is svchost.exe (specifically the Schedule service). You can also filter by the specific scheduled task name, such as \Microsoft\Kingdee\PatchCheck.

• Legacy Application Maintenance Script Execution

  • Scenario: A legacy inventory management application