IIS HTTP Logging Disabled via appcmd or PowerShell Following w3wp.exe Child Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the potential tampering of IIS logging configurations within a short duration following suspected web shell activity. It monitors for the execution of appcmd.exe or PowerShell commands that disable or modify IIS logging, specifically targeting sites or configurations after an IIS worker process (w3wp.exe) has performed activity associated with a webshell. This pattern is indicative of an attacker attempting to conceal their footprint after gaining access.