← Back to SOC feed Coverage →

Auto-generated rule - file iam.exe

yara CRITICAL Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-18T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection targets adversaries executing iam.exe, a common artifact for Identity and Access Management tools that attackers often leverage to establish persistence or manipulate user credentials within Azure environments. Proactively hunting for this specific executable is critical because its legitimate appearance can mask malicious activity such as lateral movement or privilege escalation, requiring analysts to validate execution contexts against baseline behaviors in Sentinel.

YARA Rule

rule iam_iam : Toolkit  {
	meta:
		description = "Auto-generated rule - file iam.exe"
		author = "Florian Roth"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
	strings:
		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
		$s2 = "iam.exe -h administrator:mydomain:"  ascii /* PEStudio Blacklist: strings */ /* score: '40.00' */
		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii /* PEStudio Blacklist: strings */ /* score: '33.00' */
		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii /* score: '26.00' */
		$s6 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
		$s7 = "Checking LSASRV.DLL...." fullword ascii /* score: '12.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 7 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the iam.exe detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_PassTheHash.yar