Windows Process Creation: IIS appcmd Native Module Installation via Command Line
Alerts on appcmd.exe commands installing IIS native-code modules using a -name: parameter, excluding iissetup-launched setups.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-12-11
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of appcmd.exe that include both the 'install' and 'module' command-line actions, along with a '-name:' parameter used for IIS native-code module installation. Attackers may use this technique to persist on IIS servers by registering malicious or unauthorized modules. It relies on Windows process creation telemetry with fields for the executable image and full command line, and it excludes cases where the parent process is iissetup.exe.
Reporting behind it
- researchcenter.paloaltonetworks.comhttps://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- microsoft.comhttps://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: IIS appcmd Native Module Installation via Command Line"
id: ca3b7db4-0757-42c7-bb58-f547667ee977
status: test
description: This rule identifies process executions of appcmd.exe that include both the 'install' and 'module' command-line actions, along with a '-name:' parameter used for IIS native-code module installation. Attackers may use this technique to persist on IIS servers by registering malicious or unauthorized modules. It relies on Windows process creation telemetry with fields for the executable image and full command line, and it excludes cases where the parent process is iissetup.exe.
references:
- https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-12-11
modified: 2024-03-13
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \appcmd.exe
- OriginalFileName: appcmd.exe
selection_cli:
CommandLine|contains|all:
- install
- module
CommandLine|contains|windash: "-name:"
filter_iis_setup:
ParentImage: C:\Windows\System32\inetsrv\iissetup.exe
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown as it may vary from organisation to organisation how admins use to install IIS modules
level: medium
license: DRL-1.1
related:
- id: 9465ddf4-f9e4-4ebd-8d98-702df3a93239
type: derived