Webserver IIS module installed (PowerShell)

title: Webserver IIS module installed (PowerShell)
description: Detects scenarios where an attacker attempts to deploy an IIS module via PowerShell.
references:
- https://www.splunk.com/en_us/blog/security/fantastic-iis-modules-and-how-to-find-them.html
- https://learn.microsoft.com/en-us/powershell/module/webadministration/new-webglobalmodule?view=windowsserver2022-ps
tags:
- attack.persistence
- attack.t1505.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'New-WebGlobalModule'
      - '-Image'
      - '.dll'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - 'New-WebGlobalModule'
      - '-Image'
      - '.dll'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'New-WebGlobalModule'
      - '-Image'
      - '.dll'

  condition: 1 of selection*
falsepositives:
- New modules deployed on IIS Web servers, but also Exchange and ADCS servers
level: high