Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil

Flags w3wp.exe-launched appcmd.exe module registrations involving PowerShell publication or gacutil GAC installation.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Microsoft (idea) (SigmaHQ), DRL 1.1
Published: 2022-08-04
Updated: 2026-07-31

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1505.004IIS Components
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where IIS worker processes (w3wp.exe) spawn appcmd.exe to add an IIS module. It further narrows the activity to module deployment patterns that include publishing via PowerShell and/or installation of a module assembly through gacutil. Such actions matter because IIS module registration can persistently introduce backend code execution paths on the server. The detection relies on process creation telemetry capturing ParentImage, CommandLine, and Image fields for w3wp.exe-driven module installation.

Reporting behind it

Related detections9 linkedT1505.004 — drag to rearrange

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Suspicious BadIIS Native Module Registration via cmd Copy

Malicious Native IIS Module Installation via Appcmd by UAT-8099

Malicious BadIIS Module Load into IIS Worker Process by UAT-8099

Suspicious Malicious IIS Module DLL Written to Inetsrv Directory (via file_event)

Malicious Webserver IIS Configuration Edited - SYSMON (via file_event)

Malicious Webserver IIS Module Installed - Command (via process_creation)

Malicious Webserver IIS Module Installed - Command (via process_creation) - Variant 2

Malicious Webserver IIS Module Installed - PowerShell (via powershell)

Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil

Pivot detection · T1505.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-iis-module-registration-via-appcmd-and-powershell-043c4b8b

title: Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil
id: 994582fa-7789-4e68-aefe-dd42cce7e2a8
status: test
description: This rule flags process creation where IIS worker processes (w3wp.exe) spawn appcmd.exe to add an IIS module. It further narrows the activity to module deployment patterns that include publishing via PowerShell and/or installation of a module assembly through gacutil. Such actions matter because IIS module registration can persistently introduce backend code execution paths on the server. The detection relies on process creation telemetry capturing ParentImage, CommandLine, and Image fields for w3wp.exe-driven module installation.
references:
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml
author: Florian Roth (Nextron Systems), Microsoft (idea), Huntrule Team
date: 2022-08-04
modified: 2023-01-23
tags:
  - attack.persistence
  - attack.t1505.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \w3wp.exe
  selection_cli_1:
    CommandLine|contains: appcmd.exe add module
  selection_cli_2:
    CommandLine|contains: " system.enterpriseservices.internal.publish"
    Image|endswith: \powershell.exe
  selection_cli_3:
    CommandLine|contains|all:
      - gacutil
      - " /I"
  condition: selection_parent and 1 of selection_cli_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: 043c4b8b-3a54-4780-9682-081cb6b8185c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL