Cyber Security: Microsoft IIS Source

Source Description

This source uses Microsoft IIS web server logs. Its rules detect scanning and brute-force attempts, command, SQL, and template expression injection, directory traversal, SSRF and RFI, requests without a User-Agent or from blacklisted addresses, and IIS configuration changes.

The rules analyze HTTP requests to IIS sites and web server configuration changes. Some rules correlate web requests with process execution on the web server host to detect vulnerability exploitation and web shells.

Collection Requirements

• enable logging to ETW events in IIS (Log Event Destination) and enable the Microsoft-IIS-Logging/Logs channel; see Configuring Infrastructure Sources
• enable the Microsoft-IIS-Configuration/Operational channel
• use the IIS collection configuration; see Connecting and Configuring Data Collection

MITRE ATT&CK Coverage

The source rules cover the following tactics.

• reconnaissance
• initial access
• persistence
• defense impairment
• credential access
• discovery

Lookups

The source rules enrich incidents with context from infrastructure and account lookups, while exclusion lookups filter out legitimate activity. See Lookups for population requirements.

Documents Included with the Module

The "Cyber Security Expertise Description" document included with the module lists the source rules, their MITRE ATT&CK tactics and techniques, identifiers, and lookups.