Sigma rule: Microsoft IIS Service Account Password Dumped

Rule

Title

Microsoft IIS Service Account Password Dumped

Status

test

Level

high

Author

Tim Rauch, Janantha Marasinghe, Elastic (original idea)

Date

2022-11-08

Modified

2023-01-22

File

rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Log source

product

windows

category

process_creation

Detection

selection_base_name:
    - Image|endswith: '\appcmd.exe'
    - OriginalFileName: 'appcmd.exe'
selection_base_list:
    CommandLine|contains: 'list '
selection_standalone:
    CommandLine|contains:
        - ' /config' # https://pbs.twimg.com/media/FgydDAJWIAEio34?format=png&name=900x900
        - ' /xml'
        # We cover the "-" version just in case :)
        - ' -config'
        - ' -xml'
selection_cmd_flags:
    CommandLine|contains:
        - ' /@t' # Covers both "/@text:*" and "/@t:*"
        - ' /text'
        - ' /show'
        # We cover the "-" version just in case :)
        - ' -@t'
        - ' -text'
        - ' -show'
selection_cmd_grep:
    CommandLine|contains:
        - ':\*'
        - 'password'
condition: all of selection_base_* and (selection_standalone or all of selection_cmd_*)

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1003

MITRE ATT&CK ids this rule names

• T1003

References

• https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html
• https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA
• https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml