BadIIS-Style AppCmd IIS Module Installation From Suspicious Path
Detects appcmd.exe installing an IIS native module from a user-writable or non-standard path, a persistence technique used by the BadIIS lwxat ecosystem and earlier BadIIS variants. The detection broadens beyond specific module names to catch any module installation with the structural characteristics of the malware family: appcmd.exe registering native modules from non-System32 paths, with both 32-bit and 64-bit variants, from cmd.exe or service host parents.
Microsoft Sentinel (KQL)
