Windows IIS configuration change disables ETW logging/processing option

title: Windows IIS configuration change disables ETW logging/processing option
id: 4cc385de-f9cd-48ef-92c8-e1a38a7d296f
status: test
description: This rule flags IIS configuration updates where the change record indicates disabling or removing an ETW-based logging/processing option. Attackers may impair visibility by tampering with server logging, which can hinder detection and incident response. The detection relies on IIS configuration change events (EventID 29) including the targeted configuration key ending with '@logTargetW3C' and an OldValue containing 'ETW' without the corresponding NewValue also containing 'ETW'.
references:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2024-10-06
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1505.004
logsource:
  product: windows
  service: iis-configuration
detection:
  selection:
    EventID: 29
    Configuration|endswith: "@logTargetW3C"
    OldValue|contains: ETW
  filter_main_etw_added:
    NewValue|contains: ETW
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: a5b40a90-baf5-4bf7-a6f7-373494881d22
    type: derived