Windows IIS appcmd Creating GlobalRules URL Rewrite Configuration
Flags appcmd.exe commands that modify IIS global URL rewrite globalRules and commit the configuration.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-22
- Updated
- 2026-07-31
What it detects
This rule flags process executions of appcmd.exe where the command line includes setting rewrite global rules under system.webServer/rewrite/globalRules and committing the configuration. Creating or modifying global URL rewrite rules can be used to influence request routing at the IIS level, which may help attackers expose or reach malicious web components. The detection relies on process creation telemetry (Image/OriginalFileName and CommandLine content) from Windows.
Reporting behind it
- twitter.comhttps://twitter.com/malmoeb/status/1616702107242971144
- learn.microsoft.comhttps://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-iis-appcmd-creates-global-url-rewrite-rules-via-config-commit-7c8af9b2
title: Windows IIS appcmd Creating GlobalRules URL Rewrite Configuration
id: 572c4e55-9df4-4dec-93d7-564fc4b86cba
status: test
description: This rule flags process executions of appcmd.exe where the command line includes setting rewrite global rules under system.webServer/rewrite/globalRules and committing the configuration. Creating or modifying global URL rewrite rules can be used to influence request routing at the IIS level, which may help attackers expose or reach malicious web components. The detection relies on process creation telemetry (Image/OriginalFileName and CommandLine content) from Windows.
references:
- https://twitter.com/malmoeb/status/1616702107242971144
- https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \appcmd.exe
- OriginalFileName: appcmd.exe
selection_cli:
CommandLine|contains|all:
- set
- config
- section:system.webServer/rewrite/globalRules
- "commit:"
condition: all of selection_*
falsepositives:
- Legitimate usage of appcmd to add new URL rewrite rules
level: medium
license: DRL-1.1
related:
- id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08
type: derived