InetMgr.exe
IIS Manager file version info
Program on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real InetMgr.exe?
Installed in
C:\Windows\system32\inetsrv\Signed byMicrosoft Windows
ProductInternet Information Services, Microsoft Corporation
DescriptionIIS Manager
2 known copies
10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\inetsrv\InetMgr.exe · signed by Microsoft Windows
5458371e9680fe89a0d1964aa50d10cc8f9aa86fde82d4ac69b2ac6cff4875548.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\inetsrv\InetMgr.exe · not signed
b30947d6cf4ea9fd67a8b2d2be43109e9ddafe9cb20c9bcfba0e1e7a65375ad5From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names InetMgr.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.