← Back to SOC feed Coverage →

Detects a chinese MSSQL scanner

yara MEDIUM Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-28T11:00:01Z · Confidence: medium

Hunt Hypothesis

This detection rule identifies reconnaissance activity from Chinese-origin MSSQL scanners that probe network infrastructure for vulnerable database endpoints. Proactive hunting is essential to uncover early-stage threat actors leveraging these specific tools to map attack surfaces and identify potential entry points before initiating lateral movement or data exfiltration campaigns within the Azure Sentinel environment.

YARA Rule

rule CN_Hacktool_1433_Scanner {
	meta:
		description = "Detects a chinese MSSQL scanner"
		author = "Florian Roth"
		score = 40
		date = "12.10.2014"
	strings:
		$magic = { 4d 5a }
		$s0 = "1433" wide fullword
		$s1 = "1433V" wide
		$s2 = "del Weak1.txt" ascii fullword
		$s3 = "del Attack.txt" ascii fullword
		$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" fullword ascii
		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
	condition:
		( $magic at 0 ) and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 7 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects a Chinese MSSQL Scanner” rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_THOR_HackTools.yar