This detection rule identifies reconnaissance activity from Chinese-origin MSSQL scanners that probe network infrastructure for vulnerable database endpoints. Proactive hunting is essential to uncover early-stage threat actors leveraging these specific tools to map attack surfaces and identify potential entry points before initiating lateral movement or data exfiltration campaigns within the Azure Sentinel environment.
rule CN_Hacktool_1433_Scanner {
meta:
description = "Detects a chinese MSSQL scanner"
author = "Florian Roth"
score = 40
date = "12.10.2014"
strings:
$magic = { 4d 5a }
$s0 = "1433" wide fullword
$s1 = "1433V" wide
$s2 = "del Weak1.txt" ascii fullword
$s3 = "del Attack.txt" ascii fullword
$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" fullword ascii
$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
condition:
( $magic at 0 ) and all of ($s*)
}
This YARA rule can be deployed in the following contexts:
This rule contains 7 string patterns in its detection logic.
Here are 4 specific false positive scenarios for the “Detects a Chinese MSSQL Scanner” rule, including suggested filters and exclusions:
Scenario: Legitimate Third-Party Database Backup Solution
10.50.20.x) and restrict the alert to occur only outside standard business hours (e.g., 02:00–06:00 local time) when these scheduled jobs run.Scenario: Internal Compliance & Audit Automation
AUDIT-SRV-01). Additionally, exclude alerts generated during known maintenance windows defined in the Change Management system.Scenario: Cloud Migration & Schema Synchronization Tool