Rule Info
Name
Previously Installed IIS Module Was Removed
Author
Nasreddine Bencherchali
Description
Detects the removal of a previously installed IIS module.
Reference
Date
2024-10-06 00:00:00
Modified
None
Id
9e1a1fdf-ee58-40ce-8e15-b66ca5a80e1f
Tags
attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #5966 from @nasbench - Update mitre tags to use attack v19
2026-04-29
github-actions[bot]
Merge PR #5637 from @nasbench - Promote older rules status from `experimental` to `test`
2025-09-22
frack113
Merge PR #4935 from @frack113 - Add new IIS logsource and related rules
2024-10-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR