Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
18
15
13
3
2
Contributors
13
11
10
3
3
Categories
18
15
13
11
7
Platforms
52
3
2
Products / Services
46
6
6
5
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the use of AppCmd.exe to disable HTTP logging on IIS servers. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution events where AppCmd.exe is used with specific parameters to alter logging settings. This activity is significant because disabling HTTP logging can help adversaries hide their tracks and avoid detection by removing evidence of their actions. If confirmed malicious, this could allow attackers to operate undetected, making it difficult to trace their activities and respond to the intrusion effectively.
The following analytic detects the execution of AppCmd.exe to install a new module in IIS. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use it to install webshells or backdoors, leading to credit card scraping, persistence, and further post-exploitation. If confirmed malicious, this could allow attackers to maintain persistent access, execute arbitrary code, and potentially exfiltrate sensitive information from the compromised web server.
The following analytic detects the usage of PowerShell Cmdlets - New-WebGlobalModule, Enable-WebGlobalModule, and Set-WebGlobalModule, which are used to create, enable, or modify IIS Modules. This detection leverages PowerShell Script Block Logging, specifically monitoring EventCode 4104 for these cmdlets. This activity is significant as adversaries may use these lesser-known cmdlets to manipulate IIS configurations, similar to AppCmd.exe, potentially bypassing traditional defenses. If confirmed malicious, this could allow attackers to persist in the environment, manipulate web server behavior, or escalate privileges.
The following analytic detects the addition of new IIS modules on a Windows IIS server. It leverages the Windows Event log - Microsoft-IIS-Configuration/Operational, specifically EventCode 29, to identify this activity. This behavior is significant because IIS modules are rarely added to production servers, and unauthorized modules could indicate malicious activity. If confirmed malicious, an attacker could use these modules to execute arbitrary code, escalate privileges, or maintain persistence within the environment, potentially compromising the server and sensitive data.
The following analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
This rule detects unauthorized or suspicious registration of native Internet Information Services (IIS) modules. It monitors command-line activity involving common administrative tools used to modify IIS configurations (appcmd.exe) and manage .NET assemblies (gacutil.exe), as well as the execution of specific PowerShell cmdlets like New-WebGlobalModule. Such activities are often indicative of an attacker attempting to establish persistence on a web server by loading malicious modules.
Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
This rule detects the uninstallation or removal of the ModSecurity module from an IIS server, followed by suspicious POST requests to .aspx files within a 30-minute window. This behavioral pattern is indicative of an attacker disabling web application firewall (WAF) protections before attempting to exploit vulnerabilities or upload web shells.
Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.
This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.
Detects upload of malicious modules to web server application directories
IIS Native Module Upload Attempt
Suricata
This rule detects attempts to upload a DLL file to an 'modules' directory on an IIS web server using an HTTP PUT request. This activity is indicative of an adversary attempting to establish persistence by installing a malicious IIS native module.
Detects appcmd.exe installing an IIS native module from a user-writable or non-standard path, a persistence technique used by the BadIIS lwxat ecosystem and earlier BadIIS variants. The detection broadens beyond specific module names to catch any module installation with the structural characteristics of the malware family: appcmd.exe registering native modules from non-System32 paths, with both 32-bit and 64-bit variants, from cmd.exe or service host parents.
Detects the addition of a new module to an IIS server.
Detects the removal of a previously installed IIS module.
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
Page 1 of 3