Suspicious IIS WebServer Log Removal through CommandLine Utilities (via process_creation)

title: Suspicious IIS WebServer Log Removal through CommandLine Utilities (via process_creation)
id: 385def3b-ffcd-5a74-81ee-b9d58a2bc2eb
status: stable
description: This rule detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion method used by adversaries to cover their tracks. Threat actors frequently misuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
references:
    - https://attack.mitre.org/techniques/T1070/
    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
author: Huntrule Team
date: 2026-06-08
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'cmd.exe'
              - 'powershell.exe'
              - 'powershell_ise.exe'
              - 'pwsh.dll'
    selection_cli_del:
        CommandLine|contains:
            - 'del '
            - 'erase '
            - 'rm '
            - 'remove-item '
            - 'rmdir '
    selection_cli_iis_dir:
        CommandLine|contains: '\inetpub\logs\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium