Data Source: Windows IIS

Date: 2025-01-23

ID: 469335b3-b6ad-49e2-bbe6-47e15c1464a7

Author: Patrick Bareiss, Splunk

Logs changes to IIS server configuration, including updates to settings, modules, authentication methods, and site bindings.

Property	Value
Source	`IIS:Configuration:Operational`
Sourcetype	`IIS:Configuration:Operational`
Separator	EventID

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Exchange Autodiscover SSRF Abuse	Exploit Public-Facing Application, External Remote Services	TTP
Windows IIS Server PSWA Console Access	Exploit Public-Facing Application	Hunting

Source: GitHub | Version: 2