Windows Process Creation: Command-Line Deletion of IIS Logs

title: "Windows Process Creation: Command-Line Deletion of IIS Logs"
id: 9a6ec4f2-e972-4b42-a7e3-dbfe9fcf1670
related:
  - id: 3eb8c339-a765-48cc-a150-4364c04652bf
    type: similar
  - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
    type: derived
status: experimental
description: This rule identifies Windows processes launched via common command-line utilities that include commands to delete files or folders and reference the IIS logs directory. Deleting IIS logs can help an attacker remove evidence of web activity and reduce detection coverage. It relies on process creation telemetry with command-line content and process image/original filename fields to match the deletion intent and the target directory.
references:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iis_logs_deletion.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-02
tags:
  - attack.stealth
  - attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \cmd.exe
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - cmd.exe
        - powershell.exe
        - powershell_ise.exe
        - pwsh.dll
  selection_cli_del:
    CommandLine|contains:
      - "del "
      - "erase "
      - "rm "
      - "remove-item "
      - "rmdir "
  selection_cli_iis_dir:
    CommandLine|contains: \inetpub\logs\
  condition: all of selection_*
falsepositives:
  - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
  - Legitimate schedule tasks or scripts that clean up log files regularly.
level: medium
license: DRL-1.1