Windows IIS Native-Code Module Installation via appcmd.exe Command Line

title: Windows IIS Native-Code Module Installation via appcmd.exe Command Line
id: ca3b7db4-0757-42c7-bb58-f547667ee977
status: test
description: This rule flags process executions of appcmd.exe where the command line includes both 'install' and 'module' and uses a native module name parameter (e.g., '-name:'). It matters because attackers can use IIS module installation to persistently extend server behavior. The detection relies on Windows process creation telemetry, matching on the appcmd.exe process identity and specific command-line substrings, while excluding cases started from inetsrv\iissetup.exe.
references:
  - https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-12-11
modified: 2024-03-13
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \appcmd.exe
    - OriginalFileName: appcmd.exe
  selection_cli:
    CommandLine|contains|all:
      - install
      - module
    CommandLine|contains|windash: "-name:"
  filter_iis_setup:
    ParentImage: C:\Windows\System32\inetsrv\iissetup.exe
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown as it may vary from organisation to organisation how admins use to install IIS modules
level: medium
license: DRL-1.1
related:
  - id: 9465ddf4-f9e4-4ebd-8d98-702df3a93239
    type: derived