Windows IIS WebServer Access Log Files Deleted

Alerts when IIS access log files (.log) under inetpub\logs\LogFiles\ are deleted.

FreeUnreviewedSigmamediumv1

windows-iis-webserver-access-log-files-deleted-3eb8c339

title: Windows IIS WebServer Access Log Files Deleted
id: 1ebe3f4d-e47e-4217-bd19-0c5c90c0861a
related:
  - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
    type: similar
  - id: 3eb8c339-a765-48cc-a150-4364c04652bf
    type: derived
status: test
description: This rule flags deletions of Windows IIS web server access log files under the inetpub\logs\LogFiles\ directory that end with a .log extension. Attackers may remove these logs to reduce visibility into web requests and hinder forensic investigations. It relies on file deletion telemetry that includes the deleted target file path.
references:
  - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml
author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-16
modified: 2023-02-15
tags:
  - attack.stealth
  - attack.t1070
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    TargetFilename|contains: \inetpub\logs\LogFiles\
    TargetFilename|endswith: .log
  condition: selection
falsepositives:
  - During uninstallation of the IIS service
  - During log rotation
level: medium
license: DRL-1.1

What it detects

This rule flags deletions of Windows IIS web server access log files under the inetpub\logs\LogFiles\ directory that end with a .log extension. Attackers may remove these logs to reduce visibility into web requests and hinder forensic investigations. It relies on file deletion telemetry that includes the deleted target file path.

Known false positives

During uninstallation of the IIS service
During log rotation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.