win:iis 29
IIS module added or removed (Microsoft-IIS-Configuration/Operational)
Configuration change events for IIS. Event ID 29 records a module added or removed; Event ID 50 records a site web.config change. Malicious IIS modules are a web shell variant that can hide traffic from the W3C log.
- Log source
- IIS logs
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Channel is disabled by default: wevtutil sl Microsoft-IIS-Configuration/Operational /e:true.
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Splunk 1, Sigma 4
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Sigma 4
- ETW Logging/Processing Option Disabled On IIS Server by frack113, Nasreddine Bencherchali
- HTTP Logging Disabled On IIS Server by frack113
- New Module Module Added To IIS Server by frack113
- Previously Installed IIS Module Was Removed by Nasreddine Bencherchali