Tag
IIS AppCmd Tool Used to Dump Service Account Credentials
2 rules 2 TTPsAttackers with access to IIS web servers may use the AppCmd command-line tool to dump sensitive configuration data, including application pool credentials, potentially leading to lateral movement and privilege escalation.
Microsoft IIS Connection String Decryption via aspnet_regiis
3 rules 1 TTPAn attacker with Microsoft IIS web server access can decrypt and dump hardcoded connection strings, such as MSSQL service account passwords, using the aspnet_regiis utility, potentially leading to credential compromise.
IIS HTTP Logging Disabled via AppCmd
2 rules 1 TTPAn attacker with IIS server access can disable HTTP Logging using `appcmd.exe` to evade defenses and prevent forensic analysis, as detected by the execution of `appcmd.exe` with arguments to disable logging.
Microsoft IIS Service Account Password Dump via AppCmd
2 rules 2 TTPsAn attacker with IIS web server access via a web shell can extract service account passwords by requesting full configuration output or targeting credential-related fields using the AppCmd tool.
Detection of IIS HTTP Logging Disabled via AppCmd.exe
2 rules 2 TTPsThis analytic detects the use of AppCmd.exe to disable HTTP logging on IIS servers, allowing adversaries to evade detection by removing evidence of their actions.