HTTP Logging Disabled On IIS Server

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•22

Detects changes to the IIS server configuration to disable HTTP logging for successful requests. This can be an indicator of an adversary attempting to hide their activity on a compromised web server.