This detection targets adversaries executing iam.exe, a common artifact for Identity and Access Management tools that attackers often leverage to establish persistence or manipulate user credentials within Azure environments. Proactively hunting for this specific executable is critical because its legitimate appearance can mask malicious activity such as lateral movement or privilege escalation, requiring analysts to validate execution contexts against baseline behaviors in Sentinel.
rule iam_iam : Toolkit {
meta:
description = "Auto-generated rule - file iam.exe"
author = "Florian Roth"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
date = "2015-07-10"
score = 80
hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
strings:
$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii /* PEStudio Blacklist: strings */ /* score: '59.00' */
$s2 = "iam.exe -h administrator:mydomain:" ascii /* PEStudio Blacklist: strings */ /* score: '40.00' */
$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii /* PEStudio Blacklist: strings */ /* score: '33.00' */
$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii /* score: '26.00' */
$s6 = "Error in cmdline!. Bye!." fullword ascii /* score: '12.00' */
$s7 = "Checking LSASRV.DLL...." fullword ascii /* score: '12.00' */
condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
This YARA rule can be deployed in the following contexts:
This rule contains 7 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the iam.exe detection rule in an enterprise environment, along with suggested filters or exclusions:
AWS IAM Identity Center Synchronization
iam.exe to update local user permissions and role mappings on domain-joined workstations, generating file creation or modification events that mimic suspicious activity.aws-sso-agent.exe (or similar AWS service executable) occurring between 05:30 and 07:30 UTC on weekdays.Microsoft Defender for Identity Cloud Connector Updates
iam.exe to write new configuration files and rotate certificates on the endpoint, triggering file integrity alerts.iam.exe when launched by the Windows Update service (TrustedInstaller.exe) or specifically by DefenderIdentityAgentService.exe.Just-In-Time (JIT) Privileged Access Management (PAM)
iam.exe to inject temporary credentials and modify the local security policy (Local Security Authority Subsystem Service) before the admin session begins, resulting in legitimate file writes to the %ProgramFiles%\IAM\ directory.iam.exe executions originating from known PAM client paths (e.g., `C:\Program Files\CyberArk\