Microsoft IIS Service Account Password Dumped

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•27

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords or configuration details that may contain sensitive information. This activity indicates an attempt to dump credentials from IIS.