Disclosed hacktool set (old stuff) - file iecv.exe

Hunt Hypothesis

This hunt hypothesis identifies adversaries leveraging the legacy iecv.exe hacktool to establish a foothold or execute malicious payloads within the environment. Proactive hunting for this artifact is critical in Azure Sentinel because its outdated nature suggests potential supply chain compromises or dormant threats that may evade standard signature-based defenses, necessitating immediate investigation across endpoints and file shares.

YARA Rule

rule sig_238_iecv {
	meta:
		description = "Disclosed hacktool set (old stuff) - file iecv.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
	strings:
		$s1 = "Edit The Content Of Cookie " fullword wide
		$s3 = "Accessories\\wordpad.exe" fullword ascii
		$s4 = "gorillanation.com" fullword ascii
		$s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
		$s12 = "http://nirsoft.cjb.net" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for Rule: Disclosed hacktool set (old stuff) - file iecv.exe

• Legacy Kiosk Mode Deployment in Retail/Reception

  • Scenario: Enterprise kiosks or reception terminals running older versions of Windows 7/8 often utilize a custom “IECV” (Internet Explorer Configuration Viewer) wrapper to enforce strict browsing policies. These systems frequently retain the legacy iecv.exe binary as part of their immutable image, which is not updated alongside standard OS patches due to hardware constraints.
  • Filter/Exclusion: Create an EDR exclusion based on the specific host group “Kiosk-Terminals” and file path C:\Program Files\LegacyKiosk\iecv.exe. Additionally, exclude processes spawned by the parent process kiosk-agent.exe or mstsc.exe when running in kiosk mode.

• Scheduled Compliance Reporting via PowerShell

  • Scenario: The IT Operations team runs a nightly scheduled task (Task Name: “Compliance-IECV-Scan”) that invokes iecv.exe to generate browser configuration reports for regulatory audits. This script executes on all domain-joined workstations between 02:00 and 04:00, triggering the rule during off-hours when user activity is low but system maintenance is high.
  • Filter/Exclusion: Implement a time-based exclusion window (01:30–04:30) for this specific detection logic on all workstations in the “Corporate-Workstation” OU. Alternatively, exclude the rule if the parent process is powershell.exe and the command line contains arguments related to -Report or -Audit.

• Third-Party CRM Plugin Initialization

  • Scenario: A widely used Customer Relationship Management (CRM) suite installed across sales departments includes a legacy plugin that relies