Windows Process Creation: Command-Line Deletion of IIS Logs
Flags command-line attempts on Windows to delete IIS logs using common deletion utilities and the \inetpub\logs\ path.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-09-02
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes launched via common command-line utilities that include commands to delete files or folders and reference the IIS logs directory. Deleting IIS logs can help an attacker remove evidence of web activity and reduce detection coverage. It relies on process creation telemetry with command-line content and process image/original filename fields to match the deletion intent and the target directory.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Command-Line Deletion of IIS Logs"
id: 9a6ec4f2-e972-4b42-a7e3-dbfe9fcf1670
related:
- id: 3eb8c339-a765-48cc-a150-4364c04652bf
type: similar
- id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
type: derived
status: experimental
description: This rule identifies Windows processes launched via common command-line utilities that include commands to delete files or folders and reference the IIS logs directory. Deleting IIS logs can help an attacker remove evidence of web activity and reduce detection coverage. It relies on process creation telemetry with command-line content and process image/original filename fields to match the deletion intent and the target directory.
references:
- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_logs_deletion.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-02
tags:
- attack.stealth
- attack.t1070
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \cmd.exe
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- cmd.exe
- powershell.exe
- powershell_ise.exe
- pwsh.dll
selection_cli_del:
CommandLine|contains:
- "del "
- "erase "
- "rm "
- "remove-item "
- "rmdir "
selection_cli_iis_dir:
CommandLine|contains: \inetpub\logs\
condition: all of selection_*
falsepositives:
- Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
- Legitimate schedule tasks or scripts that clean up log files regularly.
level: medium
license: DRL-1.1