Suspicious IIS URL GlobalRules Rewrite Via AppCmd

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.