Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll

Hunt Hypothesis

This hunt identifies the deployment of the XScanLib.dll file, a known component of a Chinese hacktool suite associated with advanced persistent threat operations targeting intellectual property and network reconnaissance. Proactively hunting for this artifact in Azure Sentinel is critical to detect early-stage adversary presence before they establish deeper footholds or exfiltrate sensitive data through this disclosed toolset.

YARA Rule

rule CN_Toolset__XScanLib_XScanLib_XScanLib {
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
		author = "Florian Roth"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
		date = "2015/03/30"
		score = 70
		super_rule = 1
		hash0 = "af419603ac28257134e39683419966ab3d600ed2"
		hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
		hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
	strings:
		$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
		$s2 = "PlugGetUdpPort" fullword
		$s3 = "XScanLib.dll" fullword
		$s4 = "PlugGetTcpPort" fullword
		$s11 = "PlugGetVulnNum" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://qiannao.com/ls/905300366/33834c0c/
• Source Rule

False Positive Guidance

False Positive Scenarios for “Chinese Hacktool Detection Rule”

• Scenario: Legitimate Deployment of Chinese Productivity Suites

  • Context: Enterprise users install popular Chinese productivity and office suites such as WPS Office, Tencent Meeting (WeChat Work), or Alibaba DingTalk. These applications often bundle a dynamic link library named XScanLib.dll within their installation directories to handle document scanning, OCR, or real-time collaboration features.
  • Filter/Exclusion: Add an exclusion for the specific installation paths of these known applications (e.g., C:\Program Files\WPS Office\wps.exe and its subfolders) where XScanLib.dll is a native component. Alternatively, whitelist the specific SHA-256 hash of the legitimate XScanLib.dll provided by WPS or Tencent.

• Scenario: Scheduled Maintenance Jobs for Document Management Systems

  • Context: IT administrators run scheduled tasks (via Windows Task Scheduler) to perform nightly backups or indexing using a third-party document management system that utilizes Chinese middleware components. These jobs trigger the loading of XScanLib.dll during off-hours, mimicking the behavior of an active hacktool scanning files.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name and Parent Process. Exclude alerts where the parent process is Task Scheduler (svchost.exe) or a known backup agent (e.g., VeeamAgent.exe) executing during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Endpoint Protection Scanning of Local User Profiles

  • Context: The organization utilizes an endpoint detection and response (EDR) solution or a specific anti-malware agent that includes a Chinese plugin for deep content inspection. When this agent