IIS WebServer Access Logs Deleted

Title: IIS WebServer Access Logs Deleted
Status: test
Description:Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
References:
  -https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-16
modified:2023-02-15
Tags:

• -'attack.stealth'
• -'attack.t1070'

Logsource:

• category: file_delete
• product: windows

Detection:
  selection:
    TargetFilename|contains: '\inetpub\logs\LogFiles\'
    TargetFilename|endswith: '.log'
  condition:selection
Falsepositives:
  -During uninstallation of the IIS service
  -During log rotation
Level: medium