{"id":"a5b40a90-baf5-4bf7-a6f7-373494881d22","title":"ETW Logging/Processing Option Disabled On IIS Server","description":"Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2024-10-06","modified":"","tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"technique_ids":["T1505.004","T1685.001"],"logsource":{"product":"windows","service":"iis-configuration"},"falsepositives":["Legitimate administrator activity"],"references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/"],"source_path":"rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml","source_sha256":"b0baa94515b67bf02a8402e02920c98f2209e56ab9b099ac77a10717ee76f02d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ETW Logging/Processing Option Disabled On IIS Server\nid: a5b40a90-baf5-4bf7-a6f7-373494881d22\nstatus: test\ndescription: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.\nreferences:\n    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis\n    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n    - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/\nauthor: frack113, Nasreddine Bencherchali\ndate: 2024-10-06\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685.001\n    - attack.t1505.004\nlogsource:\n    product: windows\n    service: iis-configuration\ndetection:\n    selection:\n        EventID: 29\n        Configuration|endswith: '@logTargetW3C'\n        OldValue|contains: 'ETW'\n    filter_main_etw_added:\n        NewValue|contains: 'ETW'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate administrator activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.004","id":"T1505.004","name":"IIS Components","page":"techniques/enterprise/T1505.004/"},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/a5b40a90-baf5-4bf7-a6f7-373494881d22.json","kind":"sigma"}