Windows IIS module removal event (IIS-configuration EventID 29)
Detects removal of an IIS module from Windows IIS configuration events (Event ID 29).
- Product
- windows
- Service
- iis-configuration
- Author
- Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2024-10-06
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags IIS configuration changes where a module is removed, identified by an IIS-configuration event with EventID 29 containing the path /system.webServer/modules/remove. Attackers and administrators may use module removal as part of covering tracks or disrupting existing web components, so changes in IIS module configuration are security-relevant. It relies on Windows IIS configuration telemetry that records the module removal request in the event payload.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_module_removed.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows IIS module removal event (IIS-configuration EventID 29)
id: 8333233a-e143-4262-9c91-9a6950d109cb
status: test
description: This rule flags IIS configuration changes where a module is removed, identified by an IIS-configuration event with EventID 29 containing the path /system.webServer/modules/remove. Attackers and administrators may use module removal as part of covering tracks or disrupting existing web components, so changes in IIS module configuration are security-relevant. It relies on Windows IIS configuration telemetry that records the module removal request in the event payload.
references:
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
- https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_module_removed.yml
author: Nasreddine Bencherchali, Huntrule Team
date: 2024-10-06
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1685.001
- attack.t1505.004
logsource:
product: windows
service: iis-configuration
detection:
selection:
EventID: 29
Configuration|contains: /system.webServer/modules/remove
condition: selection
falsepositives:
- Legitimate administrator activity
level: low
license: DRL-1.1
related:
- id: 9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f
type: derived