Detect IIS Components in Sumo Logic CSE
Adversaries install malicious ISAPI extensions, ISAPI filters, or IIS modules on Internet Information Services (IIS) web servers to establish persistent access. These components are DLLs loaded by the IIS worker process (w3wp.exe) and have unrestricted access to all HTTP requests and responses. RGDoor (OilRig) and OwaAuth (Threat Group-3390) used this technique. IceApple is an IIS post-exploitation framework with 18 modules. Unlike web shells, IIS components are invisible to directory listing and harder to detect.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Sub-technique
- T1505.004 IIS Components
- Canonical reference
- https://attack.mitre.org/techniques/T1505/004/
Sumo Detection Query
_sourceCategory=windows/sysmon
| where EventID in ("7", "11", "13")
| eval detection_type = ""
// Part 1: IIS Component Registry Registration (Sysmon EventID 13 - RegistryEvent Value Set)
| where (EventID = "13"
AND (TargetObject matches /(?i)(W3SVC|ISAPI.Filter|ISAPI.Extension|GlobalModules|inetsrv)/)
AND (Details matches /(?i)\.dll/)
) OR
// Part 2: DLL Written to IIS Directory by Non-Installer Process (Sysmon EventID 11 - FileCreate)
(EventID = "11"
AND (TargetFilename matches /(?i)(\\system32\\inetsrv|\\inetpub|\\inetsrv)/)
AND (TargetFilename matches /(?i)\.dll$/)
AND NOT (Image matches /(?i)(msiexec|setup|pkgmgr|TiWorker|TrustedInstaller|wusa|dism)\.exe/)
) OR
// Part 3: w3wp.exe Loading DLL from Non-Standard Path (Sysmon EventID 7 - ImageLoad)
(EventID = "7"
AND (Image matches /(?i)w3wp\.exe/)
AND (ImageLoaded matches /(?i)(\\Users\\|\\Temp\\|\\ProgramData\\|\\AppData\\|\\Windows\\Temp\\)/)
AND (ImageLoaded matches /(?i)\.dll$/)
)
| eval detection_type = if(EventID = "13"
AND TargetObject matches /(?i)(W3SVC|ISAPI.Filter|ISAPI.Extension|GlobalModules|inetsrv)/
AND Details matches /(?i)\.dll/,
"IIS_Component_Registration",
if(EventID = "11"
AND TargetFilename matches /(?i)(\\system32\\inetsrv|\\inetpub|\\inetsrv)/
AND TargetFilename matches /(?i)\.dll$/,
"IIS_Dir_DLL_Write",
if(EventID = "7"
AND Image matches /(?i)w3wp\.exe/
AND ImageLoaded matches /(?i)(\\Users\\|\\Temp\\)/,
"IIS_Non_Standard_Module_Load",
"Unknown"
)))
| where detection_type != "Unknown"
| fields _messageTime, host, User, detection_type, Image, CommandLine, TargetFilename, TargetObject, Details, ImageLoaded
| sort by _messageTime descSumo Logic query for Sysmon operational events detecting malicious IIS component installation. Covers ISAPI filter/extension registry registration (EventID 13), unauthorized DLL writes to IIS web root and inetsrv directories (EventID 11), and w3wp.exe loading DLLs from user-controlled paths indicating potential IceApple-style module injection (EventID 7).
Data Sources
Required Tables
False Positives & Tuning
- Legitimate third-party IIS modules installed via vendor MSI packages during patch cycles — the installer process (msiexec.exe) is excluded, but custom wrapper scripts calling robocopy or xcopy to deploy DLLs would trigger the file write detection
- IIS URL Rewrite Module or ARR (Application Request Routing) installations that write native DLLs to inetsrv and register in GlobalModules during initial setup
- Security scanning tools or vulnerability assessment agents that load inspection DLLs into the w3wp.exe process space as part of DAST testing on IIS-hosted applications
Other platforms for T1505.004
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List IIS Global Modules (Detection Audit)
Expected signal: Sysmon EventCode 1: powershell.exe with CommandLine containing 'Get-WebGlobalModule'. No system changes made.
- Test 2Write Test DLL to IIS Directory
Expected signal: Sysmon EventCode 11: FileCreate with TargetFilename=C:\Windows\System32\inetsrv\df00tech-test.dll, Image=powershell.exe.
- Test 3Check applicationHost.config for Module Registrations
Expected signal: Sysmon EventCode 11: Read access to applicationHost.config (if configured for read monitoring). Sysmon EventCode 1: powershell.exe process.
References (5)
- https://attack.mitre.org/techniques/T1505/004/
- https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/
- https://www.crowdstrike.com/blog/iceapple-a-novel-internet-information-services-post-exploitation-framework/
- https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Unlock Pro Content
Get the full detection package for T1505.004 including response playbook, investigation guide, and atomic red team tests.