Suspicious IIS Module Registration via appcmd and PowerShell

title: Suspicious IIS Module Registration via appcmd and PowerShell
id: 994582fa-7789-4e68-aefe-dd42cce7e2a8
status: test
description: This rule identifies process executions where IIS worker processes (w3wp.exe) spawn commands that register an IIS module using appcmd.exe. It further matches suspicious module publication and PowerShell-based activity, or GAC installation behavior via gacutil. These actions can indicate attacker persistence through malicious IIS extensions, and the detection relies on Windows process creation telemetry with parent image and command-line arguments.
references:
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml
author: Florian Roth (Nextron Systems), Microsoft (idea), Huntrule Team
date: 2022-08-04
modified: 2023-01-23
tags:
  - attack.persistence
  - attack.t1505.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \w3wp.exe
  selection_cli_1:
    CommandLine|contains: appcmd.exe add module
  selection_cli_2:
    CommandLine|contains: " system.enterpriseservices.internal.publish"
    Image|endswith: \powershell.exe
  selection_cli_3:
    CommandLine|contains|all:
      - gacutil
      - " /I"
  condition: selection_parent and 1 of selection_cli_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: 043c4b8b-3a54-4780-9682-081cb6b8185c
    type: derived