IIS ETW Logging Disabled

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•20

Detects changes to the IIS server configuration to disable or remove the ETW (Event Tracing for Windows) logging/processing option. This could indicate an adversary attempting to evade detection by reducing the logging capabilities of the web server.