win:iis access_log
IIS W3C access log
One line per request. Default fields: date, time, c-ip, cs-username, s-ip, cs-method, cs-uri-stem, cs-uri-query, time-taken, sc-status, sc-win32-status, s-port, cs(User-Agent), sc-substatus, cs(Referer). Not on by default: cs-host, cs(Cookie), sc-bytes, cs-bytes, cs-version. Custom fields (IIS 8.5+) can add request headers such as X-Forwarded-For.
- Log source
- IIS logs
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- On by default in W3C format at %SystemDrive%\inetpub\logs\LogFiles\W3SVC<id>. IIS Manager > Logging > Select Fields; add X-Forwarded-For as a custom field behind a load balancer. Optionally also emit to ETW provider Microsoft-Windows-IIS-Logging (logTargetW3C).
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Splunk 2, Elastic 6, Microsoft Sentinel 15
Why this tier
ACSC web shell guidance; CISA CM0106; DISA STIG (web); NSA/ASD web shell guidance; OWASP
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Minimum | ACSC web shell guidance; CISA CM0106; DISA STIG (web); NSA/ASD web shell guidance; OWASP |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 6
Microsoft Sentinel 15
- Anomalous User Agent connection attempt
- Exchange SSRF Autodiscover ProxyShell - Detection
- Exchange Worker Process Making Remote Call
- High count of connections by client IP on many ports
- High count of failed attempts from same client IP
- High count of failed logons by a user
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Malformed user agent
- Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts
- New UserAgent observed in last 24 hours
- SUPERNOVA webshell
- Silk Typhoon Suspicious Exchange Request
- TI Map IP Entity to W3CIISLog
- TI Map IP Entity to W3CIISLog
- User agent search for log4j exploitation attempt
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA and ASD: Web shell detection guidanceDetect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020) | Names this event | quoted: web server access logs; URIs exclusively accessed by anomalous user agents; missing or unusual referer headers; off-peak access |
| ASD ACSC: Web shell guidanceWeb Shells: Threat Awareness and Guidance (2015) | Names this event | quoted: frequency analysis on the web access logs; limited user-agent variants |
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: anomalous user agents, referrer headers and IPs in web server logs; logs to preserve: access, error |
| OWASP: Application events to logLogging Cheat Sheet | Names this event | our analysis: as above |
| DISA STIG: Web server logging requirementsMicrosoft IIS 10.0 Server V3R7 (2026-02-26) | Names this event | IIST-SV-000110 (web): W3C log with Connection and Warning request headers for outcome |
| DISA STIG: Web server logging requirementsMicrosoft IIS 10.0 Server V3R7 (2026-02-26) | Names this event | IIST-SV-000111 (web): W3C log with User Agent, User Name, Referrer, Authorization header, Content-Type for identity |
| DISA STIG: Web server logging requirementsMicrosoft IIS 10.0 Server V3R7 (2026-02-26) | Names this event | IIST-SV-000103 (web): log file and ETW event destination both enabled |
| DISA STIG: Web site logging requirementsMicrosoft IIS 10.0 Site V2R15 (2026-02-26; V2R16 reported by a scanner vendor, unconfirmed) | Names this event | IIST-SI-000206 (web): log file and ETW both enabled per site |
| DISA STIG: Web site logging requirementsMicrosoft IIS 10.0 Site V2R15 (2026-02-26; V2R16 reported by a scanner vendor, unconfirmed) | Names this event | IIST-SI-000208 (web): client IP, not proxy IP, behind a load balancer (X-Forwarded-For accepted) |
| DISA STIG: Web site logging requirementsMicrosoft IIS 10.0 Site V2R15 (2026-02-26; V2R16 reported by a scanner vendor, unconfirmed) | Names this event | IIST-SI-000209 (web): W3C log with Connection and Warning request headers for outcome |
| DISA STIG: Web site logging requirementsMicrosoft IIS 10.0 Site V2R15 (2026-02-26; V2R16 reported by a scanner vendor, unconfirmed) | Names this event | IIST-SI-000210 (web): W3C log with User Agent, User Name, Referrer, Authorization header, Content-Type for identity |
| DISA SRG: Web server logging requirements (product-neutral)Web Server Security Requirements Guide V4R5 (2026-07-10) | Names this event | SRG-APP-000095 to 000100 WSR (web): event type, date and time, location, source incl. client IP behind a proxy, outcome, user identity |