Windows IIS HTTP Logging Disabled via appcmd.exe

title: Windows IIS HTTP Logging Disabled via appcmd.exe
id: 93a103b1-9c27-4db2-8458-62a89e960abe
status: test
description: This rule flags execution of appcmd.exe with command-line arguments that set the IIS HTTP logging configuration to disable logging (dontLog:true). Attackers may impair detection by reducing or removing web server request visibility. The detection relies on Windows process creation telemetry, specifically the process image name/path and the presence of configuration and httplogging parameters in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.002/T1562.002.md#atomic-test-1---disable-windows-iis-http-logging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml
author: frack113, Huntrule Team
date: 2022-01-09
modified: 2023-01-22
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \appcmd.exe
    - OriginalFileName: appcmd.exe
  selection_cli:
    CommandLine|contains|all:
      - set
      - config
      - section:httplogging
      - dontLog:true
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e
    type: derived