Suspicious ETW Logging/Processing Option Disabled On IIS Server (via iis-configuration)

title: Suspicious ETW Logging/Processing Option Disabled On IIS Server (via iis-configuration)
id: 9aefbe8e-fda8-51b6-9158-fecf02b375b4
status: stable
description: This rule detects changes to of the IIS server configuration to disable/remove the ETW logging/processing option.
references:
    - https://attack.mitre.org/techniques/T1505/004/
    - https://attack.mitre.org/techniques/T1685/001/
    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
    - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
    - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
author: Huntrule Team
date: 2026-07-25
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1685.001
    - attack.t1505.004
logsource:
    product: windows
    service: iis-configuration
detection:
    selection:
        EventID: 29
        Configuration|endswith: '@logTargetW3C'
        OldValue|contains: 'ETW'
    filter_main_etw_added:
        NewValue|contains: 'ETW'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium