Windows IIS Configuration: Disable ETW Logging/Processing via logTargetW3C Change
Identifies IIS configuration edits that remove/disable ETW logging or processing for W3C log targeting.
- Product
- windows
- Service
- iis-configuration
- Author
- frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2024-10-06
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies IIS configuration updates that disable or remove ETW-related logging/processing by changing the log target setting. Attackers may do this to reduce or disrupt forensic telemetry and hinder detection while maintaining web access. The detection relies on IIS configuration change events (EventID 29) with prior and updated configuration values involving '@logTargetW3C' and ETW.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows IIS Configuration: Disable ETW Logging/Processing via logTargetW3C Change"
id: 4cc385de-f9cd-48ef-92c8-e1a38a7d296f
status: test
description: This rule identifies IIS configuration updates that disable or remove ETW-related logging/processing by changing the log target setting. Attackers may do this to reduce or disrupt forensic telemetry and hinder detection while maintaining web access. The detection relies on IIS configuration change events (EventID 29) with prior and updated configuration values involving '@logTargetW3C' and ETW.
references:
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2024-10-06
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1685.001
- attack.t1505.004
logsource:
product: windows
service: iis-configuration
detection:
selection:
EventID: 29
Configuration|endswith: "@logTargetW3C"
OldValue|contains: ETW
filter_main_etw_added:
NewValue|contains: ETW
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate administrator activity
level: medium
license: DRL-1.1
related:
- id: a5b40a90-baf5-4bf7-a6f7-373494881d22
type: derived