IIS WebServer Access Logs Deleted

SigmaHQ Detections@sigmaHQ

•updated Oct 7, 2025•0•19

Detects the deletion of Internet Information Services (IIS) WebServer access logs, which could indicate an adversary attempting to remove forensic evidence of their activities on a compromised web server. The rule specifically looks for delete events targeting files within the common IIS log directory structure (`\inetpub\logs\LogFiles\`) with a `.log` extension.