Chinese Hacktool Set - file xport.exe

Hunt Hypothesis

This detection identifies the execution of xport.exe, a known component within the Chinese Hacktool set often associated with advanced persistent threat groups conducting reconnaissance or data exfiltration activities. Proactively hunting for this artifact in Azure Sentinel is critical to validate its legitimacy and uncover potential lateral movement, even at low severity, before it escalates into a significant data breach.

YARA Rule

rule Tools_xport {
	meta:
		description = "Chinese Hacktool Set - file xport.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
	strings:
		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
		$s3 = "%s - command line port scanner" fullword ascii
		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
		$s6 = ".\\port.ini" fullword ascii
		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
		$s9 = "http://www.xfocus.org" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file xport.exe detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Data Export via Enterprise Backup Agents

  • Context: Many enterprise backup solutions (e.g., Veeam, Commvault, or Acronis) utilize a generic executable named xport.exe to handle data extraction, log archiving, and report generation during scheduled maintenance windows. In environments with heavy Chinese vendor integrations, this file name is common for legitimate export modules.
  • Filter/Exclusion: Create an exclusion based on the Parent Process Name (e.g., VeeamAgent.exe, cvp.exe, or AcronisBackupService.exe) and restrict the rule to trigger only if the parent process is not a known trusted backup service. Additionally, exclude file paths located within standard installation directories like C:\Program Files\BackupSoftware\.

• Scenario: Scheduled Reporting Jobs by IT Management Suites

  • Context: IT Asset Management or Configuration Management tools (such as SolarWinds, ManageEngine OpManager, or ServiceNow agents) often run nightly jobs to export asset inventory, compliance reports, or software usage data. These jobs frequently invoke a local utility named xport.exe to convert internal database records into CSV or XML formats for downstream analysis.
  • Filter/Exclusion: Implement a filter that excludes events where the User Account is a dedicated service account (e.g., svc-reporting, admin-backup) rather than an interactive user login. Furthermore, exclude execution paths under specific reporting directories like C:\ProgramData\ManageEngine\Reports\.

• Scenario: Deployment and Patch Management Execution

  • Context: During software deployment cycles using tools like **Microsoft Endpoint