Chinese Hacktool Set - file iis.exe

Hunt Hypothesis

This detection identifies the presence of iis.exe, a known component of the Chinese Hacktool set often utilized by nation-state actors for reconnaissance and lateral movement within Windows environments. Proactively hunting for this file in Azure Sentinel is critical to distinguish legitimate IIS services from potential adversary implants that may be establishing persistence or preparing for data exfiltration before triggering higher-severity alerts.

YARA Rule

rule Dos_iis {
	meta:
		description = "Chinese Hacktool Set - file iis.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
	strings:
		$s1 = "comspec" fullword ascii
		$s2 = "program terming" fullword ascii
		$s3 = "WinSta0\\Defau" fullword ascii
		$s4 = "* FROM IIsWebInfo" ascii
		$s5 = "www.icehack." ascii
		$s6 = "wmiprvse.exe" fullword ascii
		$s7 = "Pid: %d" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 70KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file iis.exe detection rule, including suggested filters and exclusions:

• Scenario: Microsoft IIS Management Console Execution

  • Context: System administrators frequently launch the iis.exe executable (often located in %SystemRoot%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe or similar paths depending on the specific Chinese tool variant) to configure application pools, manage SSL bindings, or restart web services via the GUI or command line.
  • Suggested Filter: Create an exclusion for iis.exe when the parent process is explorer.exe, mmc.exe (Microsoft Management Console), or powershell.exe, and the file path matches the standard installation directory (e.g., C:\Windows\System32\inetsrv\iis.exe or a known vendor folder).

• Scenario: Scheduled Maintenance via Task Scheduler

  • Context: Enterprise environments often utilize Windows Task Scheduler to run automated health checks, log rotation scripts, or configuration backups that invoke iis.exe. These tasks typically run under the context of the “SYSTEM” account or a dedicated service account (e.g., svc_iis_admin) during off-peak hours.
  • Suggested Filter: Exclude alerts where the user principal name is NT AUTHORITY\SYSTEM or a known service account, and the process start time aligns with the defined maintenance window (e.g., 02:00–04:00 local time). Additionally, verify the command line arguments contain standard flags like /backup, /restore, or /restart.

• Scenario: Deployment via Configuration Management Tools

  • Context: During software updates or infrastructure changes, tools such as Ansible, Puppet, Chef, or Microsoft