IIS Native Module Upload Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects attempts to upload a DLL file to an 'modules' directory on an IIS web server using an HTTP PUT request. This activity is indicative of an adversary attempting to establish persistence by installing a malicious IIS native module.