IIS appcmd Installs a Native Module from a Writable Path

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•8

Detects appcmd.exe registering an IIS native module whose image is stored beneath Temp, AppData, ProgramData, Public, or a web-content directory, consistent with BadIIS deployment tooling. This activity is indicative of an adversary establishing persistence or further compromising an IIS web server by installing malicious modules.