WARNINGTROJANHuiGeZi

Hunt Hypothesis

This rule targets the execution of the HuiGeZi Trojan, a low-severity threat often used for initial access or persistence that may evade standard signature-based detections. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing potential lateral movement or data exfiltration before the adversary establishes a foothold in the environment.

YARA Rule

rule WARNINGTROJANHuiGeZi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Java Application Deployment: The HuiGeZi trojan family is historically associated with Java-based backdoors and web shell loaders. In enterprises running legacy Java web applications (e.g., Tomcat, JBoss, or WildFly), the deployment of custom JARs or WARs via CI/CD pipelines (Jenkins, GitLab CI) or manual mvn package builds may result in binary artifacts that match generic YARA signatures for Java bytecode or specific string patterns used by the trojan.

  • Filter/Exclusion: Exclude files located in standard application server directories (e.g., C:\Program Files\Apache Tomcat\webapps\, /opt/tomcat/webapps/) or files with extensions .jar, .war, and .class if the YARA rule primarily targets executable binaries or specific string offsets. Alternatively, whitelist known CI/CD service accounts or deployment scripts that write these files.

• Third-Party Plugin or Extension Installation: Many enterprise applications (e.g., Adobe Creative Suite, JetBrains IDEs, or browser-based enterprise tools) allow users or IT admins to install third-party plugins. Some of these plugins, especially those downloaded from community marketplaces or internal repositories, may contain obfuscated code or specific string literals that trigger the HuiGeZi YARA pattern.

  • Filter/Exclusion: Exclude files located in plugin-specific directories (e.g., C:\Users\<User>\.IntelliJIdea\plugins\, C:\Program Files\Adobe\Adobe Creative Cloud\Plugins\) or files created by known application installer services (e.g., msiexec.exe, setup.exe from trusted vendors). Consider whitelisting specific plugin names or versions known to be safe in the environment.

• Scheduled Maintenance or Backup Jobs: Scheduled tasks (Windows Task Scheduler, cron jobs on Linux) that perform file