Detection rules › Sigma
HTTP Logging Disabled On IIS Server
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1505.004 Server Software Component: IIS Components |
| Defense Impairment | T1685.001 Disable or Modify Tools: Disable or Modify Windows Event Log |
Event coverage
| Provider | Event | Title |
|---|---|---|
| IIS-Configuration | Event ID 29 | Changes to 'Configuration' at 'ConfigPath' have successfully been committed |
Rule body yaml
title: HTTP Logging Disabled On IIS Server
id: e8ebd53a-30c2-45bd-81bb-74befba07bdb
status: test
description: Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
references:
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
author: frack113
date: 2024-10-06
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1685.001
- attack.t1505.004
logsource:
product: windows
service: iis-configuration
detection:
selection:
EventID: 29
Configuration: '/system.webServer/httpLogging/@dontLog'
NewValue: 'true'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 29
Configuration: '/system.webServer/httpLogging/@dontLog'
NewValue: 'true'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Configuration | eq |
|
NewValue | eq |
|