Suspicious IIS URL GlobalRules Rewrite Through AppCmd (via process_creation)

title: Suspicious IIS URL GlobalRules Rewrite Through AppCmd (via process_creation)
id: 985ed759-5598-5eea-baf5-56272f9374c6
status: stable
description: This rule detects use of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.
references:
    - https://twitter.com/malmoeb/status/1616702107242971144
    - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r
author: Huntrule Team
date: 2026-01-06
tags:
    - attack.stealth
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\appcmd.exe'
        - OriginalFileName: 'appcmd.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'set'
            - 'config'
            - 'section:system.webServer/rewrite/globalRules'
            - 'commit:'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium