Unauthorized IIS Module Registration

Ethan Andrews@eandrews

•updated Feb 16, 2026•17•0•156

Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.