Windows IIS Module Removal via iis-configuration Event ID 29

title: Windows IIS Module Removal via iis-configuration Event ID 29
id: 8333233a-e143-4262-9c91-9a6950d109cb
status: test
description: "This rule flags IIS configuration events indicating that a previously installed module was removed. Attackers and administrators may remove or replace IIS modules to disrupt defenses, reduce visibility, or alter web server behavior. The detection relies on Windows IIS configuration telemetry (service: iis-configuration) capturing Event ID 29 with the configuration payload containing '/system.webServer/modules/remove'."
references:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_module_removed.yml
author: Nasreddine Bencherchali, Huntrule Team
date: 2024-10-06
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1505.004
logsource:
  product: windows
  service: iis-configuration
detection:
  selection:
    EventID: 29
    Configuration|contains: /system.webServer/modules/remove
  condition: selection
falsepositives:
  - Legitimate administrator activity
level: low
license: DRL-1.1
related:
  - id: 9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f
    type: derived