Suspicious IIS URL GlobalRules Rewrite Via AppCmd

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.

Known false positives

Legitimate usage of appcmd to add new URL rewrite rules

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious IIS URL GlobalRules Rewrite Via AppCmd
id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08
status: test
description: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.
references:
    - https://twitter.com/malmoeb/status/1616702107242971144
    - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-22
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\appcmd.exe'
        - OriginalFileName: 'appcmd.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'set'
            - 'config'
            - 'section:system.webServer/rewrite/globalRules'
            - 'commit:'
    condition: all of selection_*
falsepositives:
    - Legitimate usage of appcmd to add new URL rewrite rules
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\appcmd.exe'
    - OriginalFileName: 'appcmd.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'set'
        - 'config'
        - 'section:system.webServer/rewrite/globalRules'
        - 'commit:'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`commit:` `config` corpus 16 (sigma 15, splunk 1) `section:system.webServer/rewrite/globalRules` `set` corpus 11 (sigma 10, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\appcmd.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\appcmd.exe"`
`OriginalFileName`	eq	`appcmd.exe` corpus 7 (sigma 5, elastic 2)	`field:"OriginalFileName" kind:eq value:"appcmd.exe"`