Webserver IIS module installed (command)

title: Webserver IIS module installed (command)
description: Detects scenarios where an attacker attempts to deploy an IIS module via the gacutil tool.
references:
- https://securelist.com/owowa-credential-stealer-and-remote-access/105219/
- https://docs.microsoft.com/fr-fr/iis/get-started/introduction-to-iis/iis-modules-overview
- https://www.microsoft.com/security/blog/2021/11/08/threat-actor-dev-0322-exploiting-zoho-manageengine-adselfservice-plus/
- https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://www.welivesecurity.com/2021/08/06/anatomy-native-iis-malware/
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf
- https://securelist.com/the-sessionmanager-iis-backdoor/106868/
- https://www.mdsec.co.uk/2020/02/iis-raid-backdooring-iis-using-native-modules/
- https://github.com/0x09AL/IIS-Raid
- https://github.com/gtworek/PSBits/blob/master/Misc/Install-PSBackdoor.ps1
- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
tags:
- attack.persistence
- attack.t1505.004
author: mdecrevoisier
status: experimental
tags:
- attack.persistence
- attack.t1505.004
author: mdecrevoisier
status: experimental|
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\gacutil.exe'
    CommandLine|contains:
      - '-i'
      - '/i'
    CommandLine|contains: '.dll'
  condition: selection
falsepositives:
- New modules deployed on IIS Web servers, but also Exchange and ADCS servers
level: high