IIS HTTP Logging Disabled via appcmd to Suppress Webshell Evidence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the use of the appcmd.exe utility to disable IIS HTTP logging by setting the 'dontLog' configuration attribute to 'True'. This behavior is commonly used by attackers to hide malicious activity, such as webshell POST requests, from being captured in IIS logs.