win:iis
IIS logs
W3C access log, HTTP.sys error log (HTTPERR), Microsoft-IIS-Configuration/Operational, ETW
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 3
- Rules listed
- 29
- Events
- 5
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| DISA SRG: Web server logging requirements (product-neutral) | applies_to | SRG-APP-000089/000092 WSR (web): log startup, shutdown, access and authentication events; session logging at startup |
Techniques
Rules
Splunk 3
Sigma 4
- ETW Logging/Processing Option Disabled On IIS Server by frack113, Nasreddine Bencherchali
- HTTP Logging Disabled On IIS Server by frack113
- New Module Module Added To IIS Server by frack113
- Previously Installed IIS Module Was Removed by Nasreddine Bencherchali
Elastic 7
Microsoft Sentinel 15
- Anomalous User Agent connection attempt
- Exchange SSRF Autodiscover ProxyShell - Detection
- Exchange Worker Process Making Remote Call
- High count of connections by client IP on many ports
- High count of failed attempts from same client IP
- High count of failed logons by a user
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Malformed user agent
- Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts
- New UserAgent observed in last 24 hours
- SUPERNOVA webshell
- Silk Typhoon Suspicious Exchange Request
- TI Map IP Entity to W3CIISLog
- TI Map IP Entity to W3CIISLog
- User agent search for log4j exploitation attempt
Events
Minimum (1)
- access_logIIS W3C access log