Chinese Hacktool Set - file NTCmd.exe

Hunt Hypothesis

This hunt targets adversaries deploying the NTCmd.exe utility from the Chinese Hacktool set to establish persistent command-and-control channels or execute reconnaissance tasks within Azure environments. Proactive hunting for this specific artifact is critical because its legitimate appearance often masks early-stage intrusion activities that may evade standard signature-based detections, allowing attackers to maintain a low-profile foothold before escalating their operations.

YARA Rule

rule tools_NTCmd {
	meta:
		description = "Chinese Hacktool Set - file NTCmd.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
	strings:
		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii /* PEStudio Blacklist: os */
		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
		$s6 = "NTcmd>" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 80KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file NTCmd.exe detection rule, along with suggested filters or exclusions:

• Legitimate Scenario: Deployment of Nutanix Prism Central or AOS (Acropolis Operating System) management agents.

  • Context: In enterprise environments utilizing Nutanix hyper-converged infrastructure, the NTCmd.exe binary is a core component used by administrators to manage clusters, perform health checks, and execute firmware updates via the command line.
  • Filter/Exclusion: Exclude processes where the parent process is prism_central.exe, ntpd.exe, or any service running under the user context of NTNUTANIX or a dedicated Service Account (e.g., svc-nutanix). Additionally, whitelist the specific file hash associated with the official Nutanix release version.

• Legitimate Scenario: Execution of scheduled maintenance jobs via Microsoft System Center Configuration Manager (SCCM) or WSUS.

  • Context: IT operations teams often deploy custom scripts to patch Chinese-language applications or manage local network configurations on endpoints. These scripts frequently invoke NTCmd.exe as a helper utility during the nightly maintenance window to verify network connectivity or reset services.
  • Filter/Exclusion: Create an exclusion for execution paths located within the standard SCCM client directory (e.g., C:\Windows\CCM\) or specific application folders like C:\Program Files\Nutanix\. Filter by the parent process name ccmexec.exe and restrict the rule to trigger only if the file path is outside of these trusted directories.

• Legitimate Scenario: Automated backup verification using Veeam Backup & Replication or Commvault.

  • Context: During post-backup validation routines, enterprise backup solutions may