Chinese Hacktool Set - file iis7.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific “iis7.exe” component of a Chinese hacktool suite to establish persistence or execute reconnaissance within web server environments. Proactively hunting for this artifact in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing attackers to maintain a stealthy foothold before escalating their activities.

YARA Rule

rule Dos_iis7 {
	meta:
		description = "Chinese Hacktool Set - file iis7.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
	strings:
		$s0 = "\\\\localhost" fullword ascii
		$s1 = "iis.run" fullword ascii
		$s3 = ">Could not connecto %s" fullword ascii
		$s5 = "WHOAMI" ascii
		$s13 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 140KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file iis7.exe detection rule in an enterprise environment:

• Legacy IIS Deployment on Windows Server 2016/2019

  • Scenario: The organization utilizes a legacy web application stack where iis7.exe (the Internet Information Services executable) is actively running as the primary service for internal portals. While modern versions often use w3wp.exe, older configurations or specific deployment scripts may explicitly invoke iis7.exe during startup or configuration reloads, triggering the alert due to the file’s known association with Chinese tooling in threat intelligence feeds.
  • Filter/Exclusion: Create an exclusion for the process path \System32\inetsrv\iis7.exe (or verify the specific hash of the legitimate Microsoft-signed binary) and restrict the alert to non-standard user contexts, allowing execution from SYSTEM or Network Service.

• Automated Patch Management via SCCM/MECM

  • Scenario: During scheduled maintenance windows, System Center Configuration Manager (SCCM) deploys updates that include IIS components. The deployment agent (ccmexec.exe) spawns a child process to verify the integrity of iis7.exe or re-registers it as part of a group policy update task, causing the file to be accessed and executed in a way that mimics the behavior of the Chinese Hacktool set.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe, taskeng.exe (Task Scheduler), or MsMpEng.exe (Windows Defender), specifically when occurring between 02:00 and 04:00 local time on weekdays.

• Third-Party Backup Agent Verification

  • Scenario: Enterprise backup solutions like