Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where threat actors deploy the specific Chinese hacktool sqlr.exe to establish persistence or conduct reconnaissance within Azure environments. Proactive hunting for this artifact is critical because its presence often signals an active campaign utilizing a known toolset, allowing the SOC team to rapidly identify and contain potential compromises before they escalate into broader data exfiltration events.

YARA Rule

rule CN_Toolset_sig_1433_135_sqlr {
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
		author = "Florian Roth"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
		date = "2015/03/30"
		score = 70
		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
	strings:
		$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
		$s11 = ";DATABASE=master" fullword ascii
		$s12 = "xp_cmdshell '" fullword ascii
		$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://qiannao.com/ls/905300366/33834c0c/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the detection rule targeting sqlr.exe, along with recommended filters and exclusions:

• Scenario: Legitimate SQL Server Reporting Services Execution

  • Context: In an enterprise environment using Microsoft SQL Server, the file sqlr.exe is often a legitimate component of the SQL Server Reporting Services (SSRS) or a custom reporting utility installed by the database team. It runs periodically to generate and distribute executive dashboards.
  • Filter/Exclusion: Create an exclusion based on the Process Path and Parent Process.
    • Condition: File.Path contains \Program Files\Microsoft SQL Server\MSSQL*\ReportingServices\ReportServer\sqlr.exe AND Process.Parent.Name is w3wp.exe (IIS Worker Process) or MsMgmt.exe.

• Scenario: Scheduled Database Maintenance and Backup Jobs

  • Context: The organization utilizes a third-party backup solution (e.g., Veeam, Commvault, or a custom script) that invokes sqlr.exe as part of its nightly maintenance routine to archive transaction logs. This often runs via Windows Task Scheduler under the context of a dedicated service account.
  • Filter/Exclusion: Exclude executions where the User Account is a known service identity and the Process Command Line matches specific backup parameters.
    • Condition: Process.User is NT SERVICE\SQLRService OR DOMAIN\BackupSvcAccount AND Process.CommandLine contains keywords like /backup, /archive, or /maintenance.

• Scenario: Deployment of Chinese Enterprise Resource Planning (ERP) Modules

  • Context: The enterprise has deployed a localized ERP system (e.g., Kingdee, Yonyou, or a custom module using the sqlr.exe naming