detection.wiki

Detection rules › Sigma

IIS WebServer Log Deletion via CommandLine Utilities

Status
experimental
Severity
medium
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.

MITRE ATT&CK coverage

TacticTechniques
StealthT1070 Indicator Removal

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: IIS WebServer Log Deletion via CommandLine Utilities
id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
related:
    - id: 3eb8c339-a765-48cc-a150-4364c04652bf
      type: similar
status: experimental
description: |
    Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
    Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
references:
    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-09-02
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'cmd.exe'
              - 'powershell.exe'
              - 'powershell_ise.exe'
              - 'pwsh.dll'
    selection_cli_del:
        CommandLine|contains:
            - 'del '
            - 'erase '
            - 'rm '
            - 'remove-item '
            - 'rmdir '
    selection_cli_iis_dir:
        CommandLine|contains: '\inetpub\logs\'
    condition: all of selection_*
falsepositives:
    - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
    - Legitimate schedule tasks or scripts that clean up log files regularly.
    # More Fp cases
    # https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage#02
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith:
          - '\cmd.exe'
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'cmd.exe'
          - 'powershell.exe'
          - 'powershell_ise.exe'
          - 'pwsh.dll'

Stage 2: selection_cli_del

selection_cli_del:
    CommandLine|contains:
        - 'del '
        - 'erase '
        - 'rm '
        - 'remove-item '
        - 'rmdir '

Stage 3: selection_cli_iis_dir

selection_cli_iis_dir:
    CommandLine|contains: '\inetpub\logs\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • \inetpub\logs\
  • del corpus 5 (sigma 5)
  • erase corpus 3 (sigma 3)
  • remove-item
  • rm corpus 4 (sigma 2, splunk 2)
  • rmdir
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \powershell.exe corpus 182 (sigma 182)
  • \powershell_ise.exe corpus 41 (sigma 41)
  • \pwsh.exe corpus 168 (sigma 168)
OriginalFileNameeq
  • cmd.exe corpus 65 (sigma 43, splunk 17, elastic 5)
  • powershell.exe corpus 120 (sigma 84, splunk 30, elastic 6)
  • powershell_ise.exe corpus 51 (splunk 30, sigma 18, elastic 3)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)