New Module Module Added To IIS Server

Title: New Module Module Added To IIS Server
Status: test
Description:Detects the addition of a new module to an IIS server.
References:
  -https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  -https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  -https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  -https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Author: frack113
Date: 2024-10-06
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685.001'
• -'attack.t1505.004'

Logsource:

• product: windows
• service: iis-configuration

Detection:
  selection:
    EventID: '29'
    Configuration|contains: '/system.webServer/modules/add'
  filter_main_builtin:
    NewValue:
      -'AnonymousAuthenticationModule'
      -'CustomErrorModule'
      -'DefaultDocumentModule'
      -'DirectoryListingModule'
      -'FileCacheModule'
      -'HttpCacheModule'
      -'HttpLoggingModule'
      -'ProtocolSupportModule'
      -'RequestFilteringModule'
      -'StaticCompressionModule'
      -'StaticFileModule'
      -'TokenCacheModule'
      -'UriCacheModule'

  filter_main_remove:
    NewValue: ''
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate administrator activity
Level: medium