Windows BadIIS Module Registration
Detects the registration of a new IIS module using appcmd.exe, a technique used by adversaries to install malicious components like the BadIIS module for persistence and traffic interception. This rule looks for the specific 'chongxiede' module name or modules registered from suspicious file paths.
YARA-L
