Suspicious Microsoft IIS Connection Strings Decryption (via process_creation)

This rule detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An adversary with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.