IIS Components
Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: <code>Get{Extension/Filter}Version<...
BY SOURCE
PROCEDURES (12)
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for http
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for privilege