Try in Splunk Security Cloud

Description

The following analytic identifies the execution of the PowerShell cmdlet Get-WebGlobalModule, which lists all IIS Modules installed on a system. It leverages PowerShell input data to detect this activity by capturing the module names and the image paths of the DLLs. This activity is significant for a SOC because it can indicate an attempt to enumerate installed IIS modules, which could be a precursor to exploiting vulnerabilities or misconfigurations. If confirmed malicious, this could allow an attacker to gain insights into the web server's configuration, potentially leading to further exploitation or privilege escalation.

  • Type: Hunting

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2024-05-03
  • Author: Michael Haag, Splunk
  • ID: 20db5f70-34b4-4e83-8926-fa26119de173

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1505.004 IIS Components Persistence
T1505 Server Software Component Persistence
Kill Chain Phase
  • Installation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6



`iis_get_webglobalmodule` 
| stats count min(_time) as firstTime max(_time) as lastTime by host name image 
| rename host as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_iis_components_get_webglobalmodule_module_query_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_iis_components_get-webglobalmodule_module_query_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • host
  • name
  • image

How To Implement

You must ingest the PwSh cmdlet Get-WebGlobalModule in order to utilize this analytic. Follow https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040

Known False Positives

This analytic is meant to assist with hunting modules across a fleet of IIS servers. Filter and modify as needed.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
1.0 10 10 IIS Modules have been listed on $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2