Chinese Hacktool Set - file WAF-Bypass.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the “WAF-Bypass.exe” tool to evade Web Application Firewall controls and establish persistent footholds within Azure environments. Proactively hunting for this specific artifact is critical because its low severity classification may cause it to be overlooked by automated alerts, allowing attackers to execute reconnaissance or lateral movement undetected before escalating their activities.

YARA Rule

rule WAF_Bypass {
	meta:
		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
	strings:
		$s1 = "Email: blacksplitn@gmail.com" fullword wide
		$s2 = "User-Agent:" fullword wide
		$s3 = "Send Failed.in RemoteThread" fullword ascii
		$s4 = "www.example.com" fullword wide
		$s5 = "Get Domain:%s IP Failed." fullword ascii
		$s6 = "Connect To Server Failed." fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 7992KB and 5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file WAF-Bypass.exe detection rule, tailored for an enterprise environment:

• Web Application Firewall (WAF) Maintenance and Updates

  • Scenario: The IT Operations team performs routine maintenance on the organization’s WAF infrastructure (e.g., F5 BIG-IP, Citrix ADC, or AWS WAF). During these windows, administrators deploy a patching utility named WAF-Bypass.exe to temporarily disable specific inspection rules for high-bandwidth internal traffic before applying configuration updates.
  • Suggested Filter: Create an exclusion based on the Parent Process being a known deployment tool (e.g., Ansible, Jenkins, or SCCM) and restrict the User Account to the WAF-Admins security group.

• Automated Compliance Scanning via Scheduled Tasks

  • Scenario: A scheduled job runs nightly on the Domain Controller to scan web traffic logs for compliance gaps. The script invokes a custom utility named WAF-Bypass.exe (developed by the internal Security Engineering team) to temporarily bypass rate-limiting checks while aggregating large datasets from the SIEM.
  • Suggested Filter: Exclude events where the File Path matches the standard enterprise automation directory (e.g., C:\Program Files\InternalTools\ComplianceScanner\) and the Hash Algorithm matches a known good SHA-256 hash of the legitimate internal binary.

• Third-Party Cloud Security Agent Deployment

  • Scenario: The organization utilizes a cloud-native security suite (e.g., CrowdStrike, SentinelOne, or Trend Micro) that includes a module for optimizing web traffic inspection. During agent installation or version upgrades on endpoint servers, the installer extracts and executes WAF-Bypass.exe to configure local