IIS HTTP Logging Disabled via system.webServer/httpLogging Configuration Change

title: IIS HTTP Logging Disabled via system.webServer/httpLogging Configuration Change
id: 973b10f3-c5d6-4280-b795-c7053871e711
status: test
description: This rule flags an IIS configuration change that sets system.webServer/httpLogging/@dontLog to true, disabling HTTP logging for successful requests. Attackers may do this to reduce forensic visibility and hinder investigation of web-based activity. It relies on Windows IIS configuration change telemetry (EventID 29) that records the specific configuration path and the new value.
references:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml
author: frack113, Huntrule Team
date: 2024-10-06
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1505.004
logsource:
  product: windows
  service: iis-configuration
detection:
  selection:
    EventID: 29
    Configuration: /system.webServer/httpLogging/@dontLog
    NewValue: "true"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e8ebd53a-30c2-45bd-81bb-74befba07bdb
    type: derived