Data Source: Windows IIS

Date: 2026-05-13

ID: 469335b3-b6ad-49e2-bbe6-47e15c1464a7

Author: Patrick Bareiss, Splunk

Logs changes to IIS server configuration, including updates to settings, modules, authentication methods, and site bindings.

Property	Value
Source	`IIS:Configuration:Operational`
Sourcetype	`IIS:Configuration:Operational`
Separator	EventID

Name ▲▼	Technique ▲▼	Type ▲▼
Windows IIS Server PSWA Console Access	Exploit Public-Facing Application	Hunting
Windows Exchange Autodiscover SSRF Abuse	External Remote Services, Exploit Public-Facing Application	TTP

Source: GitHub | Version: 3