Previously Installed IIS Module Was Removed

Title: Previously Installed IIS Module Was Removed
Status: test
Description:Detects the removal of a previously installed IIS module.
References:
  -https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  -https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  -https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  -https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Author: Nasreddine Bencherchali
Date: 2024-10-06
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685.001'
• -'attack.t1505.004'

Logsource:

• product: windows
• service: iis-configuration

Detection:
  selection:
    EventID: '29'
    Configuration|contains: '/system.webServer/modules/remove'
  condition:selection
Falsepositives:
  -Legitimate administrator activity
Level: low