New Module Added To IIS Server
Detects the addition of a new module to an IIS server. Adversaries may install malicious IIS modules to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. This can be used to establish persistence or for defense evasion.
Sigma
