IIS HTTP Logging Evasion via AppCmd.exe

Adversaries targeting Microsoft Internet Information Services (IIS) servers may utilize the legitimate Windows utility AppCmd.exe to disable HTTP logging. By modifying the server configuration to set 'dontlog:true' or otherwise disabling the HTTP logging module, attackers effectively obscure their post-exploitation activities, including web shell interaction or data exfiltration attempts. This activity is a documented technique for maintaining persistence and ensuring long-term, undetected access to compromised web infrastructure. Defenders should be particularly alert to unauthorized modifications of IIS settings, especially when initiated by processes other than standard IIS management tools.

Attack Chain

1. Attacker achieves initial execution on a Windows host running IIS.
2. Attacker identifies the need to perform reconnaissance or stage data without generating forensic artifacts.
3. Attacker executes 'appcmd.exe' from the command line or a script.
4. Attacker passes specific arguments, such as 'set config' combined with 'httplogging' or 'dontlog:true', to the binary.
5. The IIS configuration store is updated, silencing HTTP logging for the target site or server.
6. Attacker proceeds with malicious operations, such as deploying web shells or exfiltrating data, without logs being generated.
7. Objective: Long-term stealthy persistence and exfiltration.

Impact

Successful evasion through the disabling of HTTP logging results in a significant visibility gap, preventing security teams from auditing successful attacks, identifying indicators of compromise in web traffic, or performing incident response for IIS-hosted applications.

Recommendation

• Deploy the Sigma rule below to monitor for process execution of 'appcmd.exe' with parameters related to logging configuration.
• Baseline administrative behavior in the environment to identify legitimate automated IIS maintenance that might trigger these alerts.
• Enable Sysmon (Event ID 1) or Windows Security Log (Event ID 4688) to capture full process command-line arguments.
• Review and restrict access to IIS administration tools to service accounts only.