Chinese Hacktool Set - file IISPutScanner.exe

Hunt Hypothesis

This detection identifies the presence of the IISPutScanner.exe tool, a known artifact associated with Chinese threat actors conducting reconnaissance and vulnerability scanning on web servers. Proactively hunting for this file in Azure Sentinel is critical to uncover early-stage adversary footprinting activities that may precede more aggressive exploitation attempts within the organization’s IIS infrastructure.

YARA Rule

rule IISPutScanner {
	meta:
		description = "Chinese Hacktool Set - file IISPutScanner.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
	strings:
		$s2 = "KERNEL32.DLL" fullword ascii
		$s3 = "ADVAPI32.DLL" fullword ascii
		$s4 = "VERSION.DLL" fullword ascii
		$s5 = "WSOCK32.DLL" fullword ascii
		$s6 = "COMCTL32.DLL" fullword ascii
		$s7 = "GDI32.DLL" fullword ascii
		$s8 = "SHELL32.DLL" fullword ascii
		$s9 = "USER32.DLL" fullword ascii
		$s10 = "OLEAUT32.DLL" fullword ascii
		$s11 = "LoadLibraryA" fullword ascii
		$s12 = "GetProcAddress" fullword ascii
		$s13 = "VirtualProtect" fullword ascii
		$s14 = "VirtualAlloc" fullword ascii
		$s15 = "VirtualFree" fullword ascii
		$s16 = "ExitProcess" fullword ascii
		$s17 = "RegCloseKey" fullword ascii
		$s18 = "GetFileVersionInfoA" fullword ascii
		$s19 = "ImageList_Add" fullword ascii
		$s20 = "BitBlt" fullword ascii
		$s21 = "ShellExecuteA" fullword ascii
		$s22 = "ActivateKeyboardLayout" fullword ascii
		$s23 = "BBABORT" fullword wide
		$s25 = "BBCANCEL" fullword wide
		$s26 = "BBCLOSE" fullword wide
		$s27 = "BBHELP" fullword wide
		$s28 = "BBIGNORE" fullword wide
		$s29 = "PREVIEWGLYPH" fullword wide
		$s30 = "DLGTEMPLATE" fullword wide
		$s31 = "TABOUTBOX" fullword wide
		$s32 = "TFORM1" fullword wide
		$s33 = "MAINICON" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and filesize > 350KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 31 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file IISPutScanner.exe detection rule in an enterprise environment:

Automated Web Server Patching via Microsoft Endpoint Configuration Manager (MECM/SCCM)
- Scenario: The SCCM agent on a web server executes a scheduled maintenance task to deploy the latest security updates for IIS. During this process, it downloads and stages IISPutScanner.exe as part of a vendor-supplied patch package before installation begins.
- Suggested Filter/Exclusion: Exclude file creation events where the parent process is ccmexec.exe (SCCM Agent) or TSMClient.exe (Task Scheduler Client) and the file path resides within the standard software distribution directory (e.g., C:\Windows\CCMCache\).
Third-Party Vulnerability Scanning by Qualys or Tenable
- Scenario: The enterprise vulnerability scanner agent performs a scheduled deep-dive scan of IIS configurations. To verify specific file permissions and integrity, the scanner extracts its own utility module named IISPutScanner.exe into a temporary working directory (e.g., %TEMP%) to execute a local check against the web server binaries.
- Suggested Filter/Exclusion: Create an exclusion for files located in temporary directories (C:\Windows\Temp, C:\ProgramData\<Vendor>\Temp) where the parent process is identified as qualysPCAgent.exe or tenable_agent.exe.
Custom PowerShell Remediation Script Execution
- Scenario: A DevOps team runs a nightly PowerShell script (IIS_Maintenance.ps1) to audit and clean up unused IIS modules. The script explicitly downloads the official IISPutScanner.exe from an internal artifact repository (e.g., Artifactory or Nexus) to