{"id":"T1505.004","name":"IIS Components","url":"https://attack.mitre.org/techniques/T1505/004","tactics":["persistence"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0068","stix_id":"x-mitre-detection-strategy--32af4177-8c33-43d8-8e2c-9e11ac6dd451","name":"Detection Strategy for T1505.004 - Malicious IIS Components","url":"https://attack.mitre.org/detectionstrategies/DET0068","analytics":[{"id":"AN0184","stix_id":"x-mitre-analytic--09ef4725-8e20-452d-b08c-f7db3cbee174","name":"Analytic 0184","description":"Adversary installs or modifies IIS components (ISAPI filters, extensions, or modules) using DLL files registered via configuration changes or administrative tools like AppCmd.exe. These components intercept or manipulate HTTP requests/responses for persistence or C2.","url":"https://attack.mitre.org/detectionstrategies/DET0068#AN0184","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"Changes to applicationhost.config or DLLs loaded by w3wp.exe","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Microsoft-IIS-Configuration","channel":"Module or ISAPI filter registration events","data_component":"DC0065","data_component_name":"Service Modification","log_source_slug":"wineventlog-microsoft-iis-configuration"}],"mutable_elements":[{"field":"TimeWindow","description":"Adjustable time frame for detecting chained events (e.g., config change + module load)"},{"field":"UserContext","description":"Scope detection to specific users or roles allowed to modify IIS components"},{"field":"WatchedPaths","description":"Specific directories such as %windir%\\System32\\inetsrv\\ for DLL monitoring"},{"field":"DLLNameEntropyThreshold","description":"Entropy or name patterns to flag suspicious DLLs registered as components"},{"field":"ParentProcessName","description":"Restrict to DLLs loaded by w3wp.exe or invoked via AppCmd.exe"}],"live":true,"detection_strategies":["DET0068"],"techniques":["T1505.004"]}],"live":true,"version":"1.0","techniques":["T1505.004"]}],"sigma_rules":[{"id":"043c4b8b-3a54-4780-9682-081cb6b8185c","title":"Suspicious IIS Module Registration","author":"Florian Roth (Nextron Systems), Microsoft (idea)","status":"test","level":"high","date":"2022-08-04","modified":"2023-01-23","description":"Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors","references":["https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.t1505.004"],"path":"rules/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml","techniques":["T1505.004"],"cves":[]},{"id":"9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f","title":"Previously Installed IIS Module Was Removed","author":"Nasreddine Bencherchali","status":"test","level":"low","date":"2024-10-06","modified":null,"description":"Detects the removal of a previously installed IIS module.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_module_removed.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"a5b40a90-baf5-4bf7-a6f7-373494881d22","title":"ETW Logging/Processing Option Disabled On IIS Server","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2024-10-06","modified":null,"description":"Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"dd857d3e-0c6e-457b-9b48-e82ae7f86bd7","title":"New Module Module Added To IIS Server","author":"frack113","status":"test","level":"medium","date":"2024-10-06","modified":null,"description":"Detects the addition of a new module to an IIS server.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/","https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_module_added.yml","techniques":["T1685.001","T1505.004"],"cves":[]},{"id":"e8ebd53a-30c2-45bd-81bb-74befba07bdb","title":"HTTP Logging Disabled On IIS Server","author":"frack113","status":"test","level":"high","date":"2024-10-06","modified":null,"description":"Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.","references":["https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis","https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/","https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging"],"logsource":{"product":"windows","service":"iis-configuration"},"tags":["attack.persistence","attack.defense-impairment","attack.t1685.001","attack.t1505.004"],"path":"rules/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml","techniques":["T1685.001","T1505.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}