Suspicious IIS Module Registration
This rule detects suspicious registration of IIS modules, a technique used by adversaries to establish persistence on web servers. It specifically looks for `w3wp.exe` (IIS worker process) as the parent process executing commands related to adding modules via `appcmd.exe`, or using PowerShell with `system.enterpriseservices.internal.publish`, or using `gacutil` with the `/I` flag. These activities are indicative of malicious IIS extensions or backdoors being installed, as described in Microsoft's threat report on IIS backdoors.
Sigma
