Detection rules › By catalog entry

Microsoft-Windows-IIS-Configuration

Catalog entry	Rules
Event ID 29	5

Event ID 29

5 detection rules reference this catalog entry. View catalog entry.

Sigma (4)

ETW Logging/Processing Option Disabled On IIS Server severity medium T1505,T1505.004,T1685,T1685.001
HTTP Logging Disabled On IIS Server severity high T1505,T1505.004,T1685,T1685.001
New Module Module Added To IIS Server severity medium T1505,T1505.004,T1685,T1685.001
Previously Installed IIS Module Was Removed severity low T1505,T1505.004,T1685,T1685.001

Splunk (1)

Windows IIS Components New Module Added severity medium T1505,T1505.004

Back to all Microsoft-Windows-IIS-Configuration catalog entries