IIS WebServer Log Deletion via CommandLine Utilities

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.

Known false positives

Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
Legitimate schedule tasks or scripts that clean up log files regularly.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070` Indicator Removal

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: IIS WebServer Log Deletion via CommandLine Utilities
id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
related:
    - id: 3eb8c339-a765-48cc-a150-4364c04652bf
      type: similar
status: experimental
description: |
    Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
    Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
references:
    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-09-02
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'cmd.exe'
              - 'powershell.exe'
              - 'powershell_ise.exe'
              - 'pwsh.dll'
    selection_cli_del:
        CommandLine|contains:
            - 'del '
            - 'erase '
            - 'rm '
            - 'remove-item '
            - 'rmdir '
    selection_cli_iis_dir:
        CommandLine|contains: '\inetpub\logs\'
    condition: all of selection_*
falsepositives:
    - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
    - Legitimate schedule tasks or scripts that clean up log files regularly.
    # More Fp cases
    # https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage#02
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\cmd.exe'
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'cmd.exe'
          - 'powershell.exe'
          - 'powershell_ise.exe'
          - 'pwsh.dll'

Stage 2: `selection_cli_del`

selection_cli_del:
    CommandLine|contains:
        - 'del '
        - 'erase '
        - 'rm '
        - 'remove-item '
        - 'rmdir '

Stage 3: `selection_cli_iis_dir`

selection_cli_iis_dir:
    CommandLine|contains: '\inetpub\logs\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\inetpub\logs\` `del` corpus 5 (sigma 5) `erase` corpus 3 (sigma 3) `remove-item` `rm` corpus 4 (sigma 2, splunk 2) `rmdir`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130) `\powershell.exe` corpus 179 (sigma 178, kusto 1) `\powershell_ise.exe` corpus 41 (sigma 41) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`cmd.exe` corpus 81 (sigma 43, elastic 21, splunk 17) `powershell.exe` corpus 138 (sigma 84, splunk 30, elastic 24) `powershell_ise.exe` corpus 51 (splunk 30, sigma 18, elastic 3) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3)	`field:"OriginalFileName" kind:eq`