Auto-generated rule on file iis.exe

Hunt Hypothesis

This detection identifies potential web server activity or unauthorized execution of IIS processes that may indicate reconnaissance or lateral movement by an adversary leveraging standard web services. Proactive hunting for these patterns in Azure Sentinel is essential to distinguish legitimate traffic from subtle anomalies that could signal early-stage compromise within the organization’s web infrastructure.

YARA Rule

rule scanarator_iis {
	meta:
		description = "Auto-generated rule on file iis.exe"
		author = "yarGen Yara Rule Generator by Florian Roth"
		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
	strings:
		$s0 = "example: iis 10.10.10.10"
		$s1 = "send error"
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Auto-generated rule on file iis.exe” detection, including suggested filters and exclusions:

• Scheduled IIS Application Pool Recycling

  • Scenario: The Windows Task Scheduler triggers a daily or hourly job to recycle application pools (e.g., RecycleAppPool), causing iis.exe to spawn child processes or modify configuration files. This is often triggered by the built-in “IIS AppPool” maintenance tasks or third-party tools like SolarWinds Server & Application Monitor.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically the wuauserv or TaskScheduler service) and the action occurs during defined maintenance windows (e.g., 02:00–04:00). Add a filter for specific Event IDs related to pool recycling.

• Deployment via Microsoft Deployment Toolkit (MDT) or SCCM

  • Scenario: During routine patching or application updates, the System Center Configuration Manager (SCCM) client executes scripts that invoke iis.exe to restart services or update web.config files on web servers. This is common in enterprise environments managing hundreds of IIS nodes.
  • Filter/Exclusion: Create an exclusion based on the user context NT SERVICE\CCMEXECUTOR or specific machine names tagged as “WebServer” in your CMDB. Filter out events where the command line arguments contain keywords like /restart, /update, or reference to SCCM deployment IDs.

• Automated SSL Certificate Renewal (Let’s Encrypt)

  • Scenario: A scheduled PowerShell script running via Windows Task Scheduler invokes iis.exe (often via appcmd) to bind new Let’s Encrypt certificates to the IIS web sites immediately after renewal.