{"id":"9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f","title":"Previously Installed IIS Module Was Removed","description":"Detects the removal of a previously installed IIS module.","author":"Nasreddine Bencherchali","status":"test","level":"low","date":"2024-10-06","modified":"","tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"technique_ids":["T1505.004","T1685.001"],"logsource":{"product":"windows","service":"iis-configuration"},"falsepositives":["Legitimate administrator activity"],"references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"],"source_path":"rules/windows/builtin/iis-configuration/win_iis_module_removed.yml","source_sha256":"ca39539ab4205dc1185b577e3c7e2a794cbac909df9996442d46672079de8247","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/iis-configuration/win_iis_module_removed.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Previously Installed IIS Module Was Removed\nid: 9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f\nstatus: test\ndescription: Detects the removal of a previously installed IIS module.\nreferences:\n    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis\n    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n    - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/\n    - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\nauthor: Nasreddine Bencherchali\ndate: 2024-10-06\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685.001\n    - attack.t1505.004\nlogsource:\n    product: windows\n    service: iis-configuration\ndetection:\n    selection:\n        EventID: 29\n        Configuration|contains: '/system.webServer/modules/remove'\n    condition: selection\nfalsepositives:\n    - Legitimate administrator activity\n# Note: Upgrade after an initial baseline\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.004","id":"T1505.004","name":"IIS Components","page":"techniques/enterprise/T1505.004/"},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f.json","kind":"sigma"}