IIS HTTP Logging Disabled via PowerShell

Swachhhanda Shrawan Poudel (Nextron Systems)

Detects attempts to disable HTTP logging in Microsoft Internet Information Services (IIS) using PowerShell commands, which may indicate adversaries attempting to evade detection by disabling logging mechanisms. This technique can impair security monitoring and incident response capabilities by eliminating valuable log data.

2025-05-06 00:00:00

None

f92ca918-580f-4997-bab8-75efe326b59b

attack.defense-evasion attack.t1562.002 attack.persistence attack.t1505.004

Nextron Sigma feed only (private)