win:iis error_log
HTTP.sys error log (HTTPERR)
Kernel-mode errors that never reach w3wp: malformed requests (BadRequest, URL_Length, Verb, Header), connection timeouts, queue-full and app-pool failures, dropped connections.
- Log source
- IIS logs
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- On by default (EnableErrorLogging=1) at %SystemRoot%\System32\LogFiles\HTTPERR; settings under HKLM\System\CurrentControlSet\Services\HTTP\Parameters.
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Elastic 1
Why this tier
CISA CM0106
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Recommended | CISA CM0106 |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: logs to preserve: error |