Disable Windows IIS HTTP Logging
This rule detects attempts to disable HTTP logging on a Windows Internet Information Services (IIS) web server using the 'appcmd.exe' utility. Specifically, it looks for command-line arguments that set the 'httplogging' section with 'dontLog:true'. This activity is associated with defense evasion tactics, as observed by threat groups like Threat Group-3390 (Bronze Union), to remove forensic evidence of their activities.
Sigma
