iis-configuration | Detection.FYI

ETW Logging/Processing Option Disabled On IIS Server

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Read More
HTTP Logging Disabled On IIS Server

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Read More
New Module Module Added To IIS Server

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects the addition of a new module to an IIS server.

Read More
Previously Installed IIS Module Was Removed

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685.001 attack.t1505.004 ·
Share on:

Detects the removal of a previously installed IIS module.

Read More