Detection rules › Sigma

Previously Installed IIS Module Was Removed

Severity
low
Author
Nasreddine Bencherchali
Source
upstream

Detects the removal of a previously installed IIS module.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.004 Server Software Component: IIS Components
Defense EvasionT1562.002 Impair Defenses: Disable Windows Event Logging

Event coverage

ProviderEvent IDTitle
IIS-Configuration29Changes to 'Configuration' at 'ConfigPath' have successfully been committed.

Stages and Predicates

Stage 1: selection

Configuration|contains: '/system.webServer/modules/remove'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Configurationmatch
  • /system.webServer/modules/remove