ETW Logging/Processing Option Disabled On IIS Server

Title: ETW Logging/Processing Option Disabled On IIS Server
Status: test
Description:Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
References:
  -https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  -https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  -https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
Author: frack113, Nasreddine Bencherchali
Date: 2024-10-06
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685.001'
• -'attack.t1505.004'

Logsource:

• product: windows
• service: iis-configuration

Detection:
  selection:
    EventID: '29'
    Configuration|endswith: '@logTargetW3C'
    OldValue|contains: 'ETW'
  filter_main_etw_added:
    NewValue|contains: 'ETW'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate administrator activity
Level: medium