Detectionlowtest

Previously Installed IIS Module Was Removed

Detects the removal of a previously installed IIS module.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Sun Oct 069e1a1fdf-ee58-40ce-8e15-b66ca5a80e1fwindows

Log Source

Windowsiis-configuration

ProductWindows← raw: windows

Serviceiis-configuration← raw: iis-configuration

Detection Logic

detection:
    selection:
        EventID: 29
        Configuration|contains: '/system.webServer/modules/remove'
    condition: selection

False Positives

Legitimate administrator activity

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f

Status

test

Level

low

Type

Detection

Created

Sun Oct 06

Author

Path

rules/windows/builtin/iis-configuration/win_iis_module_removed.yml

Raw Tags

attack.defense-evasionattack.persistenceattack.t1562.002attack.t1505.004