Windows IIS: New HTTP module added via iis-configuration EventID 29

title: "Windows IIS: New HTTP module added via iis-configuration EventID 29"
id: 22158dce-90d8-4591-b1e6-71e764e951e9
status: test
description: This rule identifies when IIS configuration adds a new entry under /system.webServer/modules, as indicated by Windows iis-configuration EventID 29. Adding modules can enable persistence and alter request handling, which attackers may use to extend functionality or deploy web-shell adjacent capabilities. It relies on IIS configuration audit telemetry containing the modules/add path and evaluates the added module name while filtering common built-in modules.
references:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/iis-configuration/win_iis_module_added.yml
author: frack113, Huntrule Team
date: 2024-10-06
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685.001
  - attack.t1505.004
logsource:
  product: windows
  service: iis-configuration
detection:
  selection:
    EventID: 29
    Configuration|contains: /system.webServer/modules/add
  filter_main_builtin:
    NewValue:
      - AnonymousAuthenticationModule
      - CustomErrorModule
      - DefaultDocumentModule
      - DirectoryListingModule
      - FileCacheModule
      - HttpCacheModule
      - HttpLoggingModule
      - ProtocolSupportModule
      - RequestFilteringModule
      - StaticCompressionModule
      - StaticFileModule
      - TokenCacheModule
      - UriCacheModule
  filter_main_remove:
    NewValue: ""
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: dd857d3e-0c6e-457b-9b48-e82ae7f86bd7
    type: derived