Rule Info
Name
Previously Installed IIS Module Was Removed
Author
Nasreddine Bencherchali
Description
Detects the removal of a previously installed IIS module.
Reference
Date
2024-10-06 00:00:00
Modified
None
Id
9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f
Tags
attack.defense-evasion attack.persistence attack.t1562.002 attack.t1505.004
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
frack113
Merge PR #4935 from @frack113 - Add new IIS logsource and related rules
2024-10-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR