Detects a chinese MSSQL scanner - component 2

Hunt Hypothesis

This rule detects reconnaissance activity from Chinese-origin MSSQL scanners that probe database endpoints to map network topology and identify potential vulnerabilities. Proactive hunting for this behavior in Azure Sentinel is critical to uncover early-stage threat actors conducting intelligence gathering before initiating more complex attacks on sensitive data repositories.

YARA Rule

rule CN_Hacktool_1433_Scanner_Comp2 {
	meta:
		description = "Detects a chinese MSSQL scanner - component 2"
		author = "Florian Roth"
		score = 40
		date = "12.10.2014"
	strings:
		$magic = { 4d 5a }
		$s0 = "1433" wide fullword
		$s1 = "1433V" wide
		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
	condition:
		( $magic at 0 ) and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the “Detects a Chinese MSSQL Scanner - Component 2” rule, including suggested filters and exclusions:

• Scenario: Legitimate Third-Party Database Health Monitoring

  • Context: Enterprise environments often deploy specialized database monitoring suites (e.g., SolarWinds DPA, Redgate SQL Monitor, or Quest Foglight) that utilize Chinese-developed scanning agents or libraries to perform deep health checks on MSSQL instances. These tools may initiate specific connection strings or query patterns that mimic the signature of a Chinese scanner.
  • Filter/Exclusion: Create an exclusion rule based on the Source IP Address range assigned to the monitoring server group (e.g., 10.50.20.x) and filter out traffic where the User Agent string contains specific vendor identifiers like “SolarWinds” or “Redgate,” even if the underlying protocol matches the scanner signature.

• Scenario: Scheduled Automated Backup Integrity Checks

  • Context: Many organizations utilize Veeam Backup & Replication or Commvault with custom scripts for MSSQL backup verification. These scheduled jobs (often running nightly via Windows Task Scheduler) may invoke a specific Chinese middleware component to validate transaction logs and index integrity, triggering the “Component 2” detection logic during its execution window.
  • Filter/Exclusion: Implement a time-based exclusion allowing the rule to bypass alerts between 01:00 AM and 04:00 AM on weekdays for traffic originating from known backup appliance IPs (e.g., 192.168.50.x). Additionally, exclude events where the Process Name matches the backup agent executable (e.g., vbrservice.exe or commvaultagent.exe).

• Scenario: Internal Compliance and Audit Scanning