IIS WebServer Log Deletion via Command-Line
Identifies attempts to remove Internet Information Services (IIS) log files using command-line utilities. Attackers who gain access to IIS-hosted applications commonly remove or truncate IIS log files to evade detection and cover post-exploitation activity. This detection looks for command-line processes (Windows CMD/PowerShell/PowerShell Core) that execute common file-deletion commands against the IIS log folder.
Sigma
