IIS Native-Code Module Command Line Installation
Detects suspicious installations of IIS native-code modules via the command line using `appcmd.exe`. This activity can be indicative of an adversary establishing persistence on a web server by installing malicious components or backdoors. The rule specifically looks for `appcmd.exe` executing with `install` and `module` in the command line, along with the `-name:` parameter, while filtering out legitimate installations performed by `iissetup.exe`.
Sigma
