HTTP Logging Disabled On IIS Server

Title: HTTP Logging Disabled On IIS Server
Status: test
Description:Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
References:
  -https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  -https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  -https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
Author: frack113
Date: 2024-10-06
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685.001'
• -'attack.t1505.004'

Logsource:

• product: windows
• service: iis-configuration

Detection:
  selection:
    EventID: '29'
    Configuration: '/system.webServer/httpLogging/@dontLog'
    NewValue: 'true'
  condition:selection
Falsepositives:
  -Unknown
Level: high