Suspicious IIS URL GlobalRules Rewrite Via AppCmd

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of the "appcmd.exe" utility to create or modify global URL rewrite rules within Internet Information Services (IIS). This activity is suspicious because threat actors have been observed leveraging this method to establish persistence or facilitate access to webshells by redirecting traffic or enabling specific paths.