MediumSplunk security content Raven Tait +1

Windows Shell or Script Execution From IIS Directory

Detects Windows command tools such as cmd, PowerShell, or pwsh being executed from the IIS installation directory. This can be indicative of exploitation of software reliant on IIS such as Exchange.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Network Devices Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source category: crowdstrike_processrollup2 sysmon_eventid_1

Known benign triggers

Occasional administrative scripts or automated tasks might execute commands in the IIS directory. These instances are rare but should be verified before raising alerts.

Detection rules

Windows Shell or Script Execution From IIS Directory

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules