Detection rules › Sigma

HTTP Logging Disabled On IIS Server

Severity
high
Author
frack113
Source
upstream

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.004 Server Software Component: IIS Components
Defense EvasionT1562.002 Impair Defenses: Disable Windows Event Logging

Event coverage

ProviderEvent IDTitle
IIS-Configuration29Changes to 'Configuration' at 'ConfigPath' have successfully been committed.

Stages and Predicates

Stage 1: selection

Configuration: '/system.webServer/httpLogging/@dontLog'
NewValue: true

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Configurationeq
  • /system.webServer/httpLogging/@dontLog
NewValueeq
  • true