ModSecurity WAF Removal via appcmd, msiexec, or PowerShell — Defence Impairment (T1562.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the uninstallation or removal of the ModSecurity module from an IIS server, followed by suspicious POST requests to .aspx files within a 30-minute window. This behavioral pattern is indicative of an attacker disabling web application firewall (WAF) protections before attempting to exploit vulnerabilities or upload web shells.