Webserver IIS module installed (command)

title: Webserver IIS module installed (command)
description: Detects scenarios where an attacker attempts to deploy an IIS module.
references:
- https://securelist.com/owowa-credential-stealer-and-remote-access/105219/
- https://docs.microsoft.com/fr-fr/iis/get-started/introduction-to-iis/iis-modules-overview
- https://www.microsoft.com/security/blog/2021/11/08/threat-actor-dev-0322-exploiting-zoho-manageengine-adselfservice-plus/
- https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://www.welivesecurity.com/2021/08/06/anatomy-native-iis-malware/
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf
- https://securelist.com/the-sessionmanager-iis-backdoor/106868/
- https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/
- https://github.com/0x09AL/IIS-Raid
- https://github.com/gtworek/PSBits/blob/master/Misc/Install-PSBackdoor.ps1
- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- https://www.splunk.com/en_us/blog/security/fantastic-iis-modules-and-how-to-find-them.html
- https://www.trendmicro.com/en_us/research/25/b/chinese-speaking-group-manipulates-seo-with-badiis.html
- https://blog.talosintelligence.com/dragon-rank-seo-poisoning/
tags:
- attack.persistence
- attack.t1505.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # C:\Windows\System32\inetsrv\appcmd.exe install module /name:MyNativeModule /image:c:\mymodule.dll
  selection:
    NewProcessName|endswith: '\appcmd.exe'
    CommandLine|contains:
      - install
      - add
    CommandLine|contains: module
  condition: selection
falsepositives:
- New modules deployed on IIS Web servers, but also Exchange and ADCS servers
level: high