IIS Application Pool credential dumping

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier (adapted from Tim Rauch and Grzegorz Tworek feedback)
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: IIS Application Pool credential dumping 
description: Detects scenarios where an attacker 
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/
- https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/
- https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html
- https://tdm.socprime.com/tdm/info/3n7KrfogcqRG/#sigma
- https://twitter.com/0gtweet/status/1588815661085917186
tags:
- attack.credential_access
- attack.t1003
author: mdecrevoisier (adapted from Tim Rauch and Grzegorz Tworek feedback)
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    - Image|endswith: '\appcmd.exe'
    - OriginalFilename: 'appcmd.exe'
  selection_arg:
    CommandLine|contains|all:
      - 'list'
      - 'apppool' # can also be 'apppools'
    #CommandLine|contains: # use in case of too many false positives
      #- '/@'
      #- text
      #- password
      #- config
  condition: selection_name and selection_arg
falsepositives:
- Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_name and selection_arg

Stage 1: `selection_name`

selection_name:
  - Image|endswith: '\appcmd.exe'
  - OriginalFilename: 'appcmd.exe'

Stage 2: `selection_arg`

selection_arg:
  CommandLine|contains|all:
    - 'list'
    - 'apppool'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`apppool` `list` corpus 4 (sigma 2, splunk 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\appcmd.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\appcmd.exe"`
`OriginalFilename`	eq	`appcmd.exe` corpus 7 (sigma 5, elastic 2)	`field:"OriginalFileName" kind:eq value:"appcmd.exe"`

IIS Application Pool credential dumping

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_name

Stage 2: selection_arg

Indicators

Stage 0: `condition`

Stage 1: `selection_name`

Stage 2: `selection_arg`