Windows Process Command-Line Deletion of IIS Log Files

Flags command-line attempts on Windows to delete IIS logs using common deletion utilities and the \inetpub\logs\ path.

FreeUnreviewedSigmamediumv1

windows-process-command-line-deletion-of-iis-log-files-0649be4a

title: Windows Process Command-Line Deletion of IIS Log Files
id: 9a6ec4f2-e972-4b42-a7e3-dbfe9fcf1670
related:
  - id: 3eb8c339-a765-48cc-a150-4364c04652bf
    type: similar
  - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
    type: derived
status: experimental
description: This rule identifies Windows process executions where the command line uses common file deletion/removal commands and targets the IIS log directory path. Attackers may delete web server logs to reduce forensic visibility during or after activity on IIS-hosted systems. It relies on process creation telemetry, matching process images associated with command-line interpreters and command-line text that includes both deletion operations and the \inetpub\logs\ path.
references:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_logs_deletion.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-02
tags:
  - attack.stealth
  - attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - cmd.exe
        - powershell.exe
        - powershell_ise.exe
        - pwsh.dll
  selection_cli_del:
    CommandLine|contains:
      - "del "
      - "erase "
      - "rm "
      - "remove-item "
      - "rmdir "
  selection_cli_iis_dir:
    CommandLine|contains: \inetpub\logs\
  condition: all of selection_*
falsepositives:
  - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
  - Legitimate schedule tasks or scripts that clean up log files regularly.
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows process executions where the command line uses common file deletion/removal commands and targets the IIS log directory path. Attackers may delete web server logs to reduce forensic visibility during or after activity on IIS-hosted systems. It relies on process creation telemetry, matching process images associated with command-line interpreters and command-line text that includes both deletion operations and the \inetpub\logs\ path.

Known false positives

Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
Legitimate schedule tasks or scripts that clean up log files regularly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.