Skip to content
Threat Feed

Tag

Httplogging

1 brief RSS
high advisory

IIS HTTP Logging Disabled via AppCmd

An attacker with IIS server access can disable HTTP Logging using `appcmd.exe` to evade defenses and prevent forensic analysis, as detected by the execution of `appcmd.exe` with arguments to disable logging.

Elastic Defend +3 defense-evasion iis httplogging appcmd windows
2r 1t