Windows IIS: appcmd creates global URL rewrite rules via config commit

title: "Windows IIS: appcmd creates global URL rewrite rules via config commit"
id: 572c4e55-9df4-4dec-93d7-564fc4b86cba
status: test
description: This rule identifies Windows process executions of appcmd.exe where the command line uses set config to modify the IIS rewrite globalRules configuration and includes a commit operation. Attackers can abuse global URL rewrite rules to route requests to malicious endpoints, including webshells. The detection relies on process creation telemetry, including the executable name/path and the full command line arguments.
references:
  - https://twitter.com/malmoeb/status/1616702107242971144
  - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \appcmd.exe
    - OriginalFileName: appcmd.exe
  selection_cli:
    CommandLine|contains|all:
      - set
      - config
      - section:system.webServer/rewrite/globalRules
      - "commit:"
  condition: all of selection_*
falsepositives:
  - Legitimate usage of appcmd to add new URL rewrite rules
level: medium
license: DRL-1.1
related:
  - id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08
    type: derived