ModSecurity IIS WAF Module Uninstallation via appcmd.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the use of the Microsoft IIS administrative tool, appcmd.exe, to uninstall ModSecurity WAF modules. This activity is a known technique used by adversaries to impair security defenses during post-exploitation, specifically observed in campaigns targeting ColdFusion servers.