Webserver IIS module installed via GAC manipulation (PowerShell)

Status: experimental
Severity: high
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to deploy an IIS module via Global Assembly cache (GAC) manipulation.

Known false positives

New modules deployed on IIS Web servers, but also Exchange and ADCS servers

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.004` Server Software Component: IIS Components

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: Webserver IIS module installed via GAC manipulation (PowerShell)
description: Detects scenarios where an attacker attempts to deploy an IIS module via Global Assembly cache (GAC) manipulation.
references:
- https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://docs.microsoft.com/fr-fr/iis/get-started/introduction-to-iis/iis-modules-overview
- https://github.com/LTruijens/powershell-gac
tags:
- attack.persistence
- attack.t1505.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'System.Reflection.Assembly'
      - 'GacInstall'
      - '.dll'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - 'System.Reflection.Assembly'
      - 'GacInstall'
      - '.dll'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'System.Reflection.Assembly'
      - 'GacInstall'
      - '.dll'

  condition: 1 of selection*
falsepositives:
- New modules deployed on IIS Web servers, but also Exchange and ADCS servers
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - 'System.Reflection.Assembly'
    - 'GacInstall'
    - '.dll'

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - 'System.Reflection.Assembly'
    - 'GacInstall'
    - '.dll'

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - 'System.Reflection.Assembly'
    - 'GacInstall'
    - '.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`.dll` corpus 3 (sigma 3) `GacInstall` `System.Reflection.Assembly`	`field:"EventData" kind:match`
`Payload`	match	`.dll` corpus 3 (sigma 3) `GacInstall` `System.Reflection.Assembly`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`.dll` corpus 3 (sigma 3) `GacInstall` `System.Reflection.Assembly`	`field:"ScriptBlockText" kind:match`

Webserver IIS module installed via GAC manipulation (PowerShell)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_powershell_native

Stage 2: selection_powershell_modern

Stage 3: selection_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection_powershell_native`

Stage 2: `selection_powershell_modern`

Stage 3: `selection_powershell_block`