win:iis 50
IIS site configuration changed (Microsoft-IIS-Configuration/Operational)
Event ID 50 records a change to a site's web.config.
- Log source
- IIS logs
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Enable the Microsoft-IIS-Configuration/Operational channel.
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.