ETW Logging/Processing Option Disabled On IIS Server

Status: test
Severity: medium
Log source: product windows, service iis-configuration
Author: frack113, Nasreddine Bencherchali
Source: github.com/SigmaHQ/sigma

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Known false positives

Legitimate administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.004` Server Software Component: IIS Components
Defense Impairment	`T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log

Telemetry coverage

Provider	Record / event type
IIS-Configuration	Event ID 29: Changes to 'Configuration' at 'ConfigPath' have successfully been committed.

Rule body

title: ETW Logging/Processing Option Disabled On IIS Server
id: a5b40a90-baf5-4bf7-a6f7-373494881d22
status: test
description: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
references:
    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
    - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
author: frack113, Nasreddine Bencherchali
date: 2024-10-06
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1685.001
    - attack.t1505.004
logsource:
    product: windows
    service: iis-configuration
detection:
    selection:
        EventID: 29
        Configuration|endswith: '@logTargetW3C'
        OldValue|contains: 'ETW'
    filter_main_etw_added:
        NewValue|contains: 'ETW'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate administrator activity
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    EventID: 29
    Configuration|endswith: '@logTargetW3C'
    OldValue|contains: 'ETW'

Stage 2: `not filter_main_etw_added`

filter_main_etw_added:
    NewValue|contains: 'ETW'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`NewValue`	match	`ETW`	`excludes:NewValue` `field:"NewValue" value:"ETW"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Configuration`	ends_with	`@logTargetW3C`	`field:"Configuration" kind:ends_with value:"@logTargetW3C"`
`OldValue`	match	`ETW`	`field:"OldValue" kind:match value:"ETW"`