IIS HTTP Logging Disabled via appcmd (T1070.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects the use of appcmd.exe to disable HTTP logging for an IIS site by setting 'dontLog' to True. Adversaries may perform this action to evade detection and prevent security logging of their activities on a compromised web server.