Threat Hunt: Suspicious IIS Module Installation via AppCmd
This query identifies suspicious use of appcmd.exe to install IIS native-code modules via command line, excluding legitimate installations initiated by iissetup.exe. It’s useful for spotting potential backdoor deployments like RGDoor or other malicious IIS extensions.
Microsoft Sentinel (KQL)
