{"id":"dd857d3e-0c6e-457b-9b48-e82ae7f86bd7","title":"New Module Module Added To IIS Server","description":"Detects the addition of a new module to an IIS server.","author":"frack113","status":"test","level":"medium","date":"2024-10-06","modified":"","tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"technique_ids":["T1505.004","T1685.001"],"logsource":{"product":"windows","service":"iis-configuration"},"falsepositives":["Legitimate administrator activity"],"references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"],"source_path":"rules/windows/builtin/iis-configuration/win_iis_module_added.yml","source_sha256":"6aadc1c7021c1283e184025a184e53d71a7cf42c7c8d185ea6fa2e8db6569042","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/iis-configuration/win_iis_module_added.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: New Module Module Added To IIS Server\nid: dd857d3e-0c6e-457b-9b48-e82ae7f86bd7\nstatus: test\ndescription: Detects the addition of a new module to an IIS server.\nreferences:\n    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis\n    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/\n    - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/\n    - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview\nauthor: frack113\ndate: 2024-10-06\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685.001\n    - attack.t1505.004\nlogsource:\n    product: windows\n    service: iis-configuration\ndetection:\n    selection:\n        EventID: 29\n        Configuration|contains: '/system.webServer/modules/add'\n    filter_main_builtin:\n        NewValue:\n            - 'AnonymousAuthenticationModule'\n            - 'CustomErrorModule'\n            - 'DefaultDocumentModule'\n            - 'DirectoryListingModule'\n            - 'FileCacheModule'\n            - 'HttpCacheModule'\n            - 'HttpLoggingModule'\n            - 'ProtocolSupportModule'\n            - 'RequestFilteringModule'\n            - 'StaticCompressionModule'\n            - 'StaticFileModule'\n            - 'TokenCacheModule'\n            - 'UriCacheModule'\n    filter_main_remove:\n        NewValue: ''\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate administrator activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1505.004","id":"T1505.004","name":"IIS Components","page":"techniques/enterprise/T1505.004/"},{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"}],"data_path":"data/detection-rules/dd857d3e-0c6e-457b-9b48-e82ae7f86bd7.json","kind":"sigma"}