Disclosed hacktool set (old stuff) - file QQ.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy or repurposed hacking tools, specifically identified as “QQ.exe,” to establish a foothold and potentially execute command-and-control operations within the environment. A proactive search in Azure Sentinel is critical because such older tooling often evades signature-based detection by mimicking legitimate software, allowing attackers to maintain persistence undetected until lateral movement or data exfiltration occurs.

YARA Rule

rule QQ_zip_Folder_QQ {
	meta:
		description = "Disclosed hacktool set (old stuff) - file QQ.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
	strings:
		$s0 = "EMAIL:[email protected]" fullword wide
		$s1 = "EMAIL:[email protected]" fullword wide
		$s4 = "QQ2000b.exe" fullword wide
		$s5 = "[email protected]" fullword ascii
		$s9 = "QQ2000b.exe" fullword ascii
		$s10 = "\\qq2000b.exe" fullword ascii
		$s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
		$s17 = "SOFTWARE\\HAOQIANG\\" fullword ascii
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Disclosed hacktool set (old stuff) - file QQ.exe,” along with recommended filters or exclusions:

• Scenario: The legacy instant messaging client Tencent QQ is actively installed and used by the Customer Support team on Windows workstations, where QQ.exe is launched daily for internal communication.

  • Filter/Exclusion: Add a path-based exclusion for the standard installation directory (e.g., C:\Program Files\Tencent\QQ\Bin\QQ.exe) or exclude the specific process name QQ.exe when the parent process is explorer.exe on user workstations.

• Scenario: A scheduled maintenance task runs nightly to archive old chat logs, utilizing a legacy script that invokes QQ.exe as a helper utility to compress data before transmission.

  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically the “Task Scheduler” service) and the file path matches the known archive job directory (e.g., C:\Scripts\LegacyArchive\QQ.exe).

• Scenario: The IT Operations team uses a custom internal deployment tool named “QuickQuery” (QQ.exe) to push configuration updates to edge devices, which is distinct from the Tencent messaging client.

  • Filter/Exclusion: Implement a file hash exclusion by calculating and whitelisting the SHA-256 hash of the specific internal QQ.exe binary used in the deployment pipeline.

• Scenario: A third-party remote support vendor utilizes an older version of their agent which includes a component named QQ.exe to facilitate screen sharing and file transfer during maintenance windows.

  • Filter/Exclusion: Create a conditional exclusion based on the user context, excluding alerts where the running account is a specific service account (e.g., `DOMAIN\